fix: wpscan URL format, searchsploit query and msf fallback

Author: Kim-San04

exploitation/metasploit_engine.py

@@ -1,10 +1,11 @@
 import logging
+import shutil
+import subprocess
 import time
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 
 logger = logging.getLogger("pentest-agent.msf")
 
-# Mapping service → recommended auxiliary/exploit modules
 SERVICE_MODULES = {
     "smb": [
         "auxiliary/scanner/smb/smb_ms17_010",
@@ -30,6 +31,50 @@
 }
 
 
+def _try_connect(password: str, port: int):
+    """Attempt a single connection to MSF RPC. Returns client or None."""
+    try:
+        from pymetasploit3.msfrpc import MsfRpcClient
+        return MsfRpcClient(password=password, port=port, ssl=False)
+    except Exception:
+        return None
+
+
+def start_msfrpcd(password: str = "msfrpc", port: int = 55553):
+    """
+    Try to connect to MSF RPC. If unavailable, start msfrpcd automatically
+    and wait up to 30 seconds for it to become ready.
+    Returns a connected client or None.
+    """
+    # Already running?
+    client = _try_connect(password, port)
+    if client:
+        logger.info(f"Metasploit RPC already running on port {port}")
+        return client
+
+    if not shutil.which("msfrpcd"):
+        logger.warning("msfrpcd not found in PATH — skipping MSF modules")
+        return None
+
+    logger.info("Starting Metasploit RPC daemon...")
+    subprocess.Popen(
+        ["msfrpcd", "-P", password, "-p", str(port), "-S", "-f"],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+
+    for i in range(30):
+        time.sleep(1)
+        client = _try_connect(password, port)
+        if client:
+            logger.info(f"Metasploit RPC daemon started successfully (took {i+1}s)")
+            return client
+        logger.debug(f"Waiting for MSF RPC... ({i+1}/30)")
+
+    logger.warning("Failed to start Metasploit RPC after 30s — skipping MSF modules")
+    return None
+
+
 class MetasploitEngine:
     def __init__(self, password: str = "msfrpc", port: int = 55553, timeout: int = 120):
         self.password = password
@@ -38,29 +83,23 @@ def __init__(self, password: str = "msfrpc", port: int = 55553, timeout: int = 1
         self._client = None
 
     def _connect(self) -> bool:
-        try:
-            from pymetasploit3.msfrpc import MsfRpcClient
-            self._client = MsfRpcClient(
-                password=self.password,
-                port=self.port,
-                ssl=False,
-            )
+        self._client = start_msfrpcd(self.password, self.port)
+        if self._client:
             logger.info(f"Connected to Metasploit RPC on port {self.port}")
             return True
-        except Exception as exc:
-            logger.warning(f"Metasploit RPC unavailable: {exc}")
-            return False
+        logger.warning("Metasploit RPC unavailable — skipping MSF modules")
+        return False
 
     def run_module(self, target: str, port: str, module_path: str) -> Dict[str, Any]:
         if not self._connect():
             return {
                 "status": "skipped",
-                "output": "Metasploit RPC not available — start with: msfconsole -x 'load msgrpc Pass=msfrpc'",
+                "output": "Metasploit RPC unavailable - skipping MSF modules",
             }
 
         try:
             client = self._client
-            module_type = module_path.split("/")[0]  # auxiliary or exploit
+            module_type = module_path.split("/")[0]
 
             if module_type == "auxiliary":
                 mod = client.modules.use("auxiliary", "/".join(module_path.split("/")[1:]))
@@ -83,11 +122,9 @@ def run_module(self, target: str, port: str, module_path: str) -> Dict[str, Any]
 
             logger.info(f"MSF module launched: {module_path} (job {job_id})")
 
-            # Wait for completion
             elapsed = 0
             while elapsed < self.timeout:
-                jobs = client.jobs.list
-                if str(job_id) not in jobs:
+                if str(job_id) not in client.jobs.list:
                     break
                 time.sleep(2)
                 elapsed += 2

exploitation/searchsploit_engine.py

@@ -7,12 +7,40 @@
 logger = logging.getLogger("pentest-agent.searchsploit")
 
 
+def _build_query(service: str, version: str) -> str:
+    """
+    Strip protocol/transport names, port numbers and generic daemon suffixes.
+    Keep only the product name and version for searchsploit.
+    e.g. "http apache httpd 2.2.8"          → "apache 2.2.8"
+         "netbios-ssn Samba smbd 3.0.20"    → "samba 3.0.20"
+         "ftp ProFTPD 1.3.1"                → "proftpd 1.3.1"
+         "ssh OpenSSH 7.4"                  → "openssh 7.4"
+         "smb microsoft-ds"                 → (empty → skipped)
+    """
+    # Protocol/transport names and generic daemon suffixes to remove
+    noise = {
+        "http", "https", "ftp", "ssh", "smtp", "smb", "rdp", "ldap",
+        "netbios", "netbios-ssn", "netbios-ns", "microsoft-ds",
+        "ssl", "tcp", "udp", "rpc", "msrpc", "domain", "sunrpc",
+        "httpd", "smbd", "sshd", "ftpd", "telnet", "pop3", "imap",
+    }
+    combined = f"{service} {version}".lower()
+    tokens = combined.split()
+    filtered = [
+        t for t in tokens
+        if t not in noise
+        and not t.startswith("-")
+        and not t.isdigit()       # Remove bare port numbers (445, 80, 22...)
+    ]
+    return " ".join(filtered).strip()
+
+
 class SearchsploitEngine:
     def run(self, service: str, version: str) -> Dict[str, Any]:
         if not shutil.which("searchsploit"):
             return {"status": "skipped", "output": "searchsploit not installed (apt install exploitdb)"}
 
-        query = f"{service} {version}".strip()
+        query = _build_query(service, version)
         if not query:
             return {"status": "skipped", "output": "Empty query"}
 

exploitation/web/wpscan_engine.py

@@ -18,6 +18,10 @@ def run(self, target_url: str) -> Dict[str, Any]:
         if not shutil.which("wpscan"):
             return {"status": "skipped", "output": "wpscan not installed (gem install wpscan)"}
 
+        # Ensure URL is properly formatted (http://IP:PORT)
+        if not target_url.startswith(("http://", "https://")):
+            target_url = f"http://{target_url}"
+
         os.makedirs(self.output_dir, exist_ok=True)
         out_file = str(self.output_dir / "wpscan_output.json")