metasploit-cursor-harness: Skill for Cursor

SMTP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Phishing and external mail abuse: load initial-access-pentest.

Ports and detection

Port	Service
25/tcp	SMTP (plain or STARTTLS)
587/tcp	SMTP submission (STARTTLS)
465/tcp	SMTPS (implicit TLS)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 25
openssl s_client -starttls smtp -crlf -connect <target>:587
nmap -p25,587 --script smtp-commands,smtp-open-relay,smtp-enum-users <target>

Workflow

Task Progress:
- [ ] Banner and command enumeration
- [ ] VRFY/EXPN user enumeration
- [ ] Open relay testing
- [ ] SPF/DMARC/DKIM checks
- [ ] Exchange NTLM info disclosure
- [ ] Document findings

Command enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "THREADS": 5}
)

CLI fallback:

nmap -p25 --script smtp-commands <target>
telnet <target> 25
# EHLO test
# 250-VRFY, 250-EXPN, 250-AUTH, etc.

VRFY user enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_vrfy",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "USER_FILE": "/path/to/users.txt", "THREADS": 5}
)

CLI fallback:

telnet <target> 25
HELO test
VRFY root
VRFY admin
smtp-user-enum -M VRFY -U users.txt -t <target>
nmap --script smtp-enum-users -p 25 <target>

EXPN user enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "USER_FILE": "/path/to/users.txt", "THREADS": 5}
)

**CLI fallback:**
```bash
telnet <target> 25
HELO test
EXPN all
EXPN staff
EXPN administrators
smtp-user-enum -M EXPN -U users.txt -t <target>