metasploit-cursor-harness: Skill for Cursor

RDP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Windows targets: load windows-pentest and internal-ad-pentest.
• Account lockout risk on brute force. Confirm ROE before spray attacks.

Ports and detection

Port	Service
3389/tcp	Remote Desktop Protocol (ms-wbt-server)
443/tcp	RD Gateway (HTTPS, when deployed)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389, "THREADS": 5}
)

CLI fallback:

nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 <target>
nc -vn <target> 3389

Workflow

Task Progress:
- [ ] NLA and encryption enumeration
- [ ] Credential validation or brute force
- [ ] BlueKeep / MS12-020 checks
- [ ] CredSSP downgrade and RD Gateway review
- [ ] Session access or tunnel setup
- [ ] Document findings

NLA and encryption enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389}
)

CLI fallback:

nmap --script rdp-enum-encryption -p 3389 <target>
nxc rdp <target> -u <user> -p <password>
nxc rdp <target> --nla-screenshot
nxc rdp <target> -u <user> -p <pass> --screenshot

Credential validation

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389, "USERNAME": "<user>", "PASSWORD": "<pass>"}
)

CLI fallback:

impacket-rdp_check <domain>/<user>:<pass>@<target>
xfreerdp /u:<user> /p:<pass> /v:<target>
xfreerdp /d:<domain> /u:<user> /pth:<NT_HASH> /v:<target>
rdesktop -d <domain> -u <user> -p <pass> <target>

Authentication brute force

MSF: No direct RDP brute-force module; use CLI.