Add -i option to Msf::Ui::Console::CommandDispatcher::Session mixin's sessions command

[errorxyz]

Fixes #18811

This PR adds a -i option to Msf::Ui::Console::CommandDispatcher::Session mixin's sessions command. This change would affect meterpreter, smb, sql consoles.

I've also updated the spec tests for the same

Verification

• Get 2 or more meterpreter sessions
• use the -i option to interact with different sessions

msf6 exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type                   Information            Connection
  --  ----  ----                   -----------            ----------
  1         meterpreter x64/linux  errorxyz @ linome.xyz  127.0.0.1:4444 -> 127.0.0.1:52652 (127.0.0.1)
  2         meterpreter x64/linux  errorxyz @ linome.xyz  127.0.0.1:4444 -> 127.0.0.1:33242 (127.0.0.1)

msf6 exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sessions -i 2
[*] Backgrounding session 1...
[*] Starting interaction with 2...

meterpreter > sessions -i 1
[*] Backgrounding session 2...
[*] Starting interaction with 1...

meterpreter > sessions -i -1
[*] Backgrounding session 1...
[*] Starting interaction with 2...

meterpreter > sessions -i 2
[*] Session 2 is already interactive.

[zeroSteiner]

I like that this makes the usage syntax consistent.

[sjanusz-r7]

Would it make sense to add in a Rex Parser here?:

@@session_opts = Rex::Parser::Arguments.new(
            ['-h', '--help] => [ false, 'Show this message' ],
            ['-i', '--interact'] => [ true, 'Interact with a provided session ID' ]
          )

@@session_opts.parse(args) do |opt, _idx, val|
              case opt
              when '-h'
                ...
              when '-i'
                ...
              else
                 ...
              end
end

[errorxyz]

Since there's only one option needed here, for simplicity's sake I feel we don't need this. If we use this, we'll also have to separately handle sessions <id> as done here. If there's plans of adding new options here, it'd make sense to use the rex parser. I'll happily add the rex parser if you still feel we should use it.

Yup will add that👍

[sjanusz-r7]

Is there a reason why this test was changed, rather than a new one added for sessions -i <id>? It seems like now we only test the -i functionality, with the previous functionality of sessions <id> not being tested.

[errorxyz]

Initially I thought since both use the same back-end, a single test would suffice. But now in hindsight, I feel we'd need two separate tests. Will add it👍

[errorxyz]

Sorry for the late response @sjanusz-r7 had some personal work, I've now made the reviewed changes.

[adfoster-r7]

This is very nice, thank you!

msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
[*] Starting interaction with 2...

sesMySQL @ 127.0.0.1:3306 () > sessions -1
[*] Backgrounding session 2...
[*] Starting interaction with 2...

MySQL @ 127.0.0.1:3306 () > sessions -2
[*] Backgrounding session 2...
[*] Starting interaction with 1...

PostgreSQL @ 127.0.0.1:9000 (template1) > sessions -i -1
[*] Backgrounding session 1...
se[*] Starting interaction with 2...

ssiMySQL @ 127.0.0.1:3306 () > sessions -i -2
[*] Backgrounding session 2...
[*] Starting interaction with 1...

PostgreSQL @ 127.0.0.1:9000 (template1) > 

[adfoster-r7]

This is a bit weird that the validation doesn't happen before attempting to swap sessions, but I believe that's existing behavior so not an issue!

PostgreSQL @ 127.0.0.1:9000 (template1) > sessions -i 3
[*] Backgrounding session 1...
[-] Invalid session identifier: 3
msf6 auxiliary(scanner/mysql/mysql_login) > 

[adfoster-r7]

Release Notes

Enhances the sessions command so that both Meterpreter and the top level Metasploit prompt support sessions -i -1.

[errorxyz]

@adfoster-r7 Another (small) issue I found while testing this was that when we switch sessions immediately after getting a meterpreter shell, we aren't prompted about the session we are switching into.

msf6 exploit(multi/handler) > run

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP handler on 127.0.0.1:4444 
[*] Sending stage (3045380 bytes) to 127.0.0.1
[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:54846) at 2024-03-21 02:40:13 +0530

meterpreter > bg
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > run

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP handler on 127.0.0.1:4444 
[*] Sending stage (3045380 bytes) to 127.0.0.1
[*] Meterpreter session 2 opened (127.0.0.1:4444 -> 127.0.0.1:43242) at 2024-03-21 02:40:24 +0530

meterpreter > sessions 1
[*] Backgrounding session 2...       # Notice that we aren't prompted about the session we are switching to
meterpreter > bg
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sessions 2
[*] Backgrounding session 1...
[*] Starting interaction with 2...   # We are prompted about the session we are switching to

meterpreter > 

It's a minor inconsistency in output, I thought I should mention it somewhere

[adfoster-r7]

Interesting! I wonder why that's happening 🤔

Agreed that it's a minor issue 💯