metasploit-cursor-harness: Skill for Cursor

Windows Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Domain-joined targets: also load internal-ad-pentest.
• Before noisy post-ex: load red-team-evasion for AMSI/EDR context.

Workflow

Task Progress:
- [ ] Enumerate OS, patches, users, groups, services, privileges
- [ ] Run privesc checklist (tokens, services, DLL hijack, unquoted paths)
- [ ] Harvest credentials (LSASS, DPAPI, registry, cached creds)
- [ ] Attempt local elevation then lateral movement

Phase 1: Enumeration

System and patch info

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_applications",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/enum_patches",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe get Caption,Description,HotFixID,InstalledOn
whoami /all

Automated: WinPEAS, Seatbelt, PrivescCheck, Watson/WES-NG for missing patches.

Users, groups, privileges

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_logged_on_users",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_send_session_command(
  session_id=<sid>,
  command="getprivs",
  engagement_id="<id>"
)

CLI fallback:

whoami /priv
whoami /groups
net user
net localgroup administrators

Look for: SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege, SeDebugPrivilege.

Services and misconfiguration

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_services",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/enum_unattended",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

wmic service get name,displayname,pathname,startmode | findstr /i "auto"
sc query
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run