How to use a Python Meterpreter payload in a Python module?

[byt3bl33d3r]

Hey there!

I'm writing a remote_exploit_cmd_stager Python exploit module I'm wanting to set the payload to be python/meterpreter/reverse_tcp. Below is my metadata variable:

metadata = {
    'name': 'My RCE',
    'description': '''
        Python module RCE.
    ''',
    'authors': [
        'byt3bl33d3r <marcello@protectai.com>' # MSF module
    ],
    'rank': 'excellent',
    'date': '2023-11-15',
    'license': 'MSF_LICENSE',
    'references': [
        {'type': 'url', 'ref': 'https://test.com'},
    ],
    'type': 'remote_exploit_cmd_stager',
    'targets': [
        {'platform': 'python', 'arch': 'python', 'type': 'python_exec', 'default_options': {'PAYLOAD': 'python/meterpreter/reverse_tcp'}}
    ],
    'arch': ['python'],
    'platform': ['python'],
    'default_options': {
        'MeterpreterTryToFork': True
    },
    'payload': {
        'command_stager_flavor': 'wget'
    },
    'options': {
        'command': {'type': 'string', 'description': 'The command to execute', 'required': True, 'default': 'echo "Hello from Metasploit"'},
        'rhost': {'type': 'address', 'description': 'Target address', 'required': True, 'default': None},
        'rport': {'type': 'port', 'description': 'Target port (TCP)', 'required': True, 'default': 8081},
        'serverport': {'type': 'port', 'description': 'HTTP server port to bind to', 'required': True, 'default': 4455},
        'ssl': {'type': 'bool', 'description': 'Negotiate SSL/TLS for outgoing connections', 'required': True, 'default': False}
    }
}

I've tried a bunch of different combos in the targets dict key and they all result in the following error:

[*] Started reverse TCP handler on 172.18.0.7:4444 
[*] Exploiting...
[-] Exploit failed: Msf::NoCompatiblePayloadError Failed to generate an executable payload due to an invalid platform or arch.
[*] Exploit completed, but no session was created.

What am I missing?

Thank you!

[zeroSteiner]

I think the issue could be due to setting the type as remote_exploit_cmd_stager which operates on ARCH_CMD instead of ARCH_PYTHON. The module type probably needs to be changed and then you should be able to get ARCH_PYTHON payloads.

[byt3bl33d3r]

@zeroSteiner Thanks ! Just for clarity what should the module type be changed to ?

[zeroSteiner]

Try using just remote_exploit.