QEMU's SLIRP hostfwd tried to bind host port 21 for the Metasploitable2
target, which fails for the non-root cis490 user (EPERM). The exploit
driver also had no way to use a different host-side port than the module's
static RPORT=21, so even if the VM had started the exploit would have
connected to the wrong port.
Fix:
- launch_target.sh: change PORT_BASE default from (21 + SLOT*100) to
(2121 + SLOT*100) so SLIRP binds non-privileged ports
- exploits/driver.py: add target_port to DriverConfig; in _fire(),
override opts["RPORT"] when target_port is set so msfrpcd connects
to the correct forwarded port
- tools/run_tier3_demo.py: pass target_port=args.target_port to DriverConfig
- scripts/install-tier-3-4.sh: --target-port 2121 (matches new default)
Closesspectral/CIS490#18
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
elliott
f4eef81807