autopwn 개발기 ② — Phase 1을 막은 세 개의 함정 (YAML scalar · grpcio · proxychains)

docker compose ps
# autopwn-msf   Restarting (127) 1 second ago

bash: line 1: msfrpcd: command not found
bash: line 2: -U: command not found
bash: line 3: -a: command not found
addgroup: group 'msf' in use

msf:
  image: metasploitframework/metasploit-framework:latest
  command: >
    bash -lc "msfrpcd -P ${MSF_RPC_PASSWORD:-msfrpcpass}
              -U ${MSF_RPC_USER:-msf}
              -a 0.0.0.0 -p 55553 -S -f"

docker run --rm --entrypoint /bin/sh metasploitframework/metasploit-framework:latest \
  -c "ls /usr/src/metasploit-framework/msfrpcd; pwd"
# /usr/src/metasploit-framework/msfrpcd
# /usr/src/metasploit-framework

msf:
  image: metasploitframework/metasploit-framework:latest
  command: ["./msfrpcd", "-P", "${MSF_RPC_PASSWORD:-msfrpcpass}",
           "-U", "${MSF_RPC_USER:-msf}",
           "-a", "0.0.0.0", "-p", "55553", "-S", "-f"]

[*] MSGRPC starting on 0.0.0.0:55553 (NO SSL):Msg...

curl -sv http://127.0.0.1:8080/healthz
# * connect to 127.0.0.1 port 8080 failed: Connection refused

File "/app/app/main.py", line 8, in <module>
  from .routers import events, findings, health, listeners, ...
File "/app/app/routers/listeners.py", line 5, in <module>
  from ..tools import sliver
File "/app/app/tools/sliver.py", line 15, in <module>
  from sliver import SliverClient, SliverClientConfig
File ".../site-packages/sliver/beacon.py", line 22, in <module>
  import grpc
ModuleNotFoundError: No module named 'grpc'

sliver-py==0.0.18
grpcio==1.66.2
protobuf==5.28.2

docker compose build api worker
docker compose up -d api worker
docker compose logs api --tail=10
# {"IsTor":true,"IP":"107.189.8.70"}
# INFO: Uvicorn running on http://0.0.0.0:8080

curl -s .../playbooks/runs/$RUN_ID | jq .steps[0].summary
# "nmap failed (rc=1): proxy tor has invalid value or is not numeric
#  non-numeric ips are only allowed under the following circumstances:
#  chaintype == strict (true), proxy is not first in list (false), pr"

strict_chain
proxy_dns
remote_dns_subnet 224
...
[ProxyList]
socks5 ${TOR_HOST} ${TOR_PORT}

# ops/docker/api-entrypoint.sh
_TOR_HOST_RAW="${TOR_HOST:-tor}"
_TOR_PORT="${TOR_PORT:-9050}"
_TOR_IP=""
for i in 1 2 3 4 5; do
  _TOR_IP="$(getent hosts "$_TOR_HOST_RAW" | awk '{print $1; exit}')"
  [[ -n "$_TOR_IP" ]] && break
  sleep 2
done
TOR_HOST="$_TOR_IP" TOR_PORT="$_TOR_PORT" \
  envsubst < /app/ops/proxychains/proxychains4.conf > /etc/proxychains4.conf
echo "[entrypoint] proxychains4.conf rendered (tor=${_TOR_HOST_RAW}→${_TOR_IP}:${_TOR_PORT})"

docker compose exec api cat /etc/proxychains4.conf | tail -3
# [ProxyList]
# # Default: Tor SOCKS5 from the `tor` service in docker-compose.
# socks5 172.18.0.3 9050

[entrypoint] proxychains4.conf rendered (tor=tor→172.18.0.3:9050)
[entrypoint] PROXY_CHAIN=true — verifying Tor reachability...
{"IsTor":true,"IP":"193.189.100.199"}

curl -s -H "X-API-Key:$KEY" http://127.0.0.1:8080/readyz | jq .
# {
#   "ok": false,
#   "proxy_chain": true,
#   "checks": {
#     "redis": true,
#     "tor": "error: Unknown scheme for proxy URL URL('socks5h://tor:9050')",
#     "msf_rpc": true
#   }
# }

curl -s -H "X-API-Key:$KEY" http://127.0.0.1:8080/modules/manifest | jq '.endpoints | length, .events | length'
# 20
# 17