metasploit-cursor-harness: Skill for Cursor

Pivoting Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Active session or shell on a dual-homed or internal foothold host.
• New subnet targets must appear in scope or engagement authorized_cidrs before scanning.

Workflow

Task Progress:
- [ ] Map foothold interfaces and routing table
- [ ] Identify unreachable in-scope subnets from the foothold
- [ ] Select pivot type (SOCKS, port forward, TUN) and tool
- [ ] Establish tunnel; validate with ping/curl/nmap through proxy
- [ ] Run recon on new subnet; log evidence and update world state

Phase 1: Recon foothold

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/gather/ipinfo",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_send_session_command(
  session_id=<sid>,
  command="ipconfig",
  engagement_id="<id>"
)

CLI fallback:

# Linux
ip addr; ip route; arp -a
# Windows
ipconfig /all
route print
arp -a

Pivot type decision tree

Need full subnet routing (layer 3)?
  -> ligolo-ng, sshuttle, Meterpreter autoroute
Need single host:port access?
  -> SSH -L/-R, portfwd, netsh portproxy, socat
Need to proxy arbitrary tools through SOCKS?
  -> chisel, SSH -D, Meterpreter socks_proxy + proxychains
Only HTTP egress from target?
  -> reGeorg, pivotnacci (web SOCKS)
Firewall blocks inbound to attacker?
  -> Reverse SOCKS (chisel R:socks, revsocks)
Multi-hop (A -> B -> C)?
  -> Chain SOCKS: foothold1 SOCKS -> foothold2 SOCKS -> target
  -> Meterpreter autoroute on each hop session

Metasploit pivoting (preferred for MSF sessions)

Autoroute

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/manage/autoroute",
  engagement_id="<id>",
  session_id=<sid>,
  options={"SUBNET": "10.10.20.0", "NETMASK": "255.255.255.0"}
)
msf_send_session_command(
  session_id=<sid>,
  command="run autoroute -s 10.10.20.0/24",
  engagement_id="<id>"
)

CLI fallback: