added a feature to allow for manual exploitation of targets if a

metasploit expoloit is not provided. This allows for exploitation of
systems that might not have know msf exploits or need to be tested

Author: hackgnar

README.md

@@ -88,7 +88,7 @@ Each config is a JSON array of exploit entries. SETC supports two target modes:
 |-------|----------|-------------|
 | `name` | Yes | CVE or exploit identifier |
 | `description` | Yes | Human-readable description |
-| `exploit` | Yes | Metasploit module path |
+| `exploit` | No | Metasploit module path (omit for manual exploit mode) |
 | `target_image` | One of these | Docker image for single-container targets |
 | `yml_file` + `target_name` | One of these | Docker Compose file + target container name |
 | `exploit_options` | No | Additional MSF console commands (semicolon-separated) |
@@ -165,6 +165,30 @@ usage: setc [-h] [-v] [-p PASSWORD] [--volume VOLUME] [--network NETWORK]
 | `--cleanup_postgres` | Remove PostgreSQL container after completion |
 | `--cleanup_elk` | Remove Elasticsearch and Kibana containers after completion |
 
+### Manual exploit mode
+
+When `exploit` is omitted (or set to `""`), SETC starts the target and tcpdump capture, then pauses and waits for you to manually exploit the target from a separate terminal. Press Enter when done and SETC proceeds with cleanup, PCAP parsing, and log conversion as usual.
+
+This is useful for exploits not in Metasploit, custom attack chains, or interactive research.
+
+```json
+[
+    {
+        "name": "CVE-2024-XXXXX",
+        "settings": {
+            "description": "Manual exploitation of custom vuln",
+            "target_image": "vuln-app:latest"
+        }
+    }
+]
+```
+
+```bash
+# SETC will start the target, then prompt you:
+#   "Press Enter when finished exploiting to continue..."
+python3 setc/setc.py manual_config.json --cleanup_volume --cleanup_network
+```
+
 ### Example runs
 
 ```bash

example_configurations/manual_small.json

@@ -0,0 +1,8 @@
+[
+    {"name":"CVE-2018-11776",
+        "settings": {
+            "description":"Struts2 OGNL injection RCE",
+            "target_image":"vulhub/struts2:2.5.25"
+        }
+    }
+]

setc/runners/base.py

@@ -38,6 +38,8 @@ def __init__(self, docker_client: docker.DockerClient, network_name: str = "set_
         self.target_name=target_name
         self.exploit_success_pattern="4444"
         self.target_logs=None
+        self.attack=None
+        self.manual=False
 
     def _prefixed(self, name: str) -> str:
         """Return the session-prefixed version of a container name."""
@@ -111,12 +113,14 @@ def setup_all(self) -> None:
         self.volume_setup()
         self.target_setup()
         self.tcpdump_setup()
-        self.attack_setup()
+        if not self.manual:
+            self.attack_setup()
 
     def cleanup_all(self) -> None:
         """Tear down target and attack containers."""
         self.target_cleanup()
-        self.attack_cleanup()
+        if self.attack is not None:
+            self.attack_cleanup()
 
     def exploit(self) -> None:
         """Execute the configured Metasploit exploit against the target."""

setc/setc.py

@@ -56,12 +56,16 @@ def validate_config(config: Any) -> list[str]:
         s = entry["settings"]
 
         # Required string fields
-        for field in ("description", "exploit"):
+        for field in ("description",):
             if field not in s:
                 errors.append(f"{prefix}: missing required setting '{field}'.")
             elif not isinstance(s[field], str):
                 errors.append(f"{prefix}: setting '{field}' must be a string.")
 
+        # exploit is optional — if present it must be a non-empty string
+        if "exploit" in s and not isinstance(s["exploit"], str):
+            errors.append(f"{prefix}: setting 'exploit' must be a string.")
+
         # Exactly one of target_image or yml_file
         has_image = "target_image" in s
         has_yml = "yml_file" in s
@@ -336,14 +340,19 @@ def main() -> None:
                 exploit_check_count=int(system_config["settings"].get("exploit_check_count", 7))
                 ready_delay=int(system_config["settings"].get("ready_delay", 5))
                 ready_retries=int(system_config["settings"].get("ready_retries", 5))
+
+                # Detect manual mode: no exploit field or empty string
+                manual = not system_config["settings"].get("exploit")
+                msf_exploit = system_config["settings"].get("exploit", "")
+
                 setc = None
                 setc_type = None
                 if "yml_file" in system_config["settings"]:
                     setc = DockerComposeMsfCli(client,
                                                vuln_name=system_config["name"],
                                                target_name=system_config["settings"]["target_name"],
                                                target_yml=system_config["settings"]["yml_file"],
-                                               msf_exploit=system_config["settings"]["exploit"],
+                                               msf_exploit=msf_exploit,
                                                msf_options=msf_options,
                                                msf_image=args.msf,
                                                prefix=prefix)
@@ -352,7 +361,7 @@ def main() -> None:
                     setc = DockerMsfCli(client,
                                         name = system_config["name"],
                                         target_image=system_config["settings"]["target_image"],
-                                        msf_exploit=system_config["settings"]["exploit"],
+                                        msf_exploit=msf_exploit,
                                         msf_options=msf_options,
                                         delay=delay,
                                         msf_image=args.msf,
@@ -362,6 +371,9 @@ def main() -> None:
                 if "exploit_success_pattern" in system_config["settings"]:
                     setc.exploit_success_pattern=system_config["settings"]["exploit_success_pattern"]
 
+                if manual:
+                    setc.manual = True
+
                 ########################################
                 ###          Pre UP Runners         ###
                 ########################################
@@ -393,9 +405,16 @@ def main() -> None:
                             break
                         tries += 1
                 logger.info("Target %s is ready for exploit", system_config["name"])
-                setc.exploit_until_success(status_delay=exploit_check_delay,
-                                           status_checks=exploit_check_count,
-                                           tries=exploit_retries)
+
+                if manual:
+                    logger.info("Manual mode: target %s is up and tcpdump is capturing traffic", system_config["name"])
+                    logger.info("Exploit the target manually, then press Enter to continue")
+                    input("Press Enter when finished exploiting to continue...")
+                    logger.info("Resuming SETC pipeline for %s", system_config["name"])
+                else:
+                    setc.exploit_until_success(status_delay=exploit_check_delay,
+                                               status_checks=exploit_check_count,
+                                               tries=exploit_retries)
 
                 ########################################
                 ###          Pre Down Runners        ###

setc_config_schema.json

@@ -21,7 +21,7 @@
         "type": "object",
         "title": "Exploit Settings",
         "description": "Configuration for the target environment and Metasploit exploit.",
-        "required": ["description", "exploit"],
+        "required": ["description"],
         "additionalProperties": true,
         "properties": {
           "description": {
@@ -32,7 +32,7 @@
           "exploit": {
             "type": "string",
             "title": "Metasploit Exploit Module",
-            "description": "Metasploit module path (e.g. multi/http/struts2_multi_eval_ognl)."
+            "description": "Metasploit module path (e.g. multi/http/struts2_multi_eval_ognl). Omit or leave empty for manual exploit mode."
           },
           "target_image": {
             "type": "string",

tests/test_unit.py

@@ -152,9 +152,22 @@ def test_missing_description(self):
         errors = validate_config(cfg)
         assert any("'description'" in e for e in errors)
 
-    def test_missing_exploit(self):
+    def test_valid_config_without_exploit(self):
+        """Config without exploit field = manual mode, should be valid."""
         cfg = self._minimal_docker()
         del cfg[0]["settings"]["exploit"]
+        assert validate_config(cfg) == []
+
+    def test_valid_config_with_empty_exploit(self):
+        """Config with empty exploit string = manual mode, should be valid."""
+        cfg = self._minimal_docker()
+        cfg[0]["settings"]["exploit"] = ""
+        assert validate_config(cfg) == []
+
+    def test_exploit_wrong_type(self):
+        """exploit field must be a string if present."""
+        cfg = self._minimal_docker()
+        cfg[0]["settings"]["exploit"] = 123
         errors = validate_config(cfg)
         assert any("'exploit'" in e for e in errors)