framework.py

#!/usr/bin/env python3
"""
Browser Exploit Orchestration Framework
=======================================

Main framework console. Provides a structured pipeline from reconnaissance
through exploitation, implant staging, and payload delivery, with validation
gates at every transition.

Architecture adapted from the Equation Group's FuzzBunch framework,
targeting browser JavaScript engines and renderer processes instead of
network services.

DISCLAIMER: This framework is for authorized security research and
defensive analysis only. Understanding offensive tooling architecture
is essential for building effective detection and prevention. Do not
use against systems without explicit written authorization.

Usage:
    python framework.py list [--category TYPE]
    python framework.py info <module>
    python framework.py touch --target <url>
    python framework.py chain --target <url> [--name <chain>]
    python framework.py run <chain> [--target <url>] [--dry-run]
    python framework.py sessions
    python framework.py interact <session_id>
"""

from __future__ import annotations

import argparse
import json
import logging
import os
import sys
import time
import uuid
from dataclasses import dataclass, field
from pathlib import Path
from typing import Any

# Framework library imports
from lib.module_loader import ModuleConfig, ModuleLoader
from lib.chain_builder import (
    ChainBuilder,
    ChainStage,
    ExploitChain,
    TouchResult,
    STAGE_ORDER,
)

# ---------------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------------
logging.basicConfig(
    level=logging.INFO,
    format="[%(asctime)s] %(levelname)-8s %(name)s: %(message)s",
    datefmt="%H:%M:%S",
)
logger = logging.getLogger("exploitframework")


# ---------------------------------------------------------------------------
# Session management (cf. FuzzBunch DoublePulsar session tracking)
# ---------------------------------------------------------------------------


@dataclass
class Session:
    """An active implant session (cf. FuzzBunch DoublePulsar sessions)."""

    session_id: str
    target: str
    browser: str = ""
    version: str = ""
    architecture: str = ""
    os_platform: str = ""
    implant_type: str = ""
    established: float = 0.0
    last_seen: float = 0.0
    status: str = "active"  # active, dormant, dead
    chain_name: str = ""
    capabilities: list[str] = field(default_factory=list)
    history: list[dict[str, Any]] = field(default_factory=list)

    def summary(self) -> str:
        age = time.time() - self.established if self.established else 0
        return (
            f"Session {self.session_id}\n"
            f"  Target:    {self.target}\n"
            f"  Browser:   {self.browser} {self.version}\n"
            f"  Arch:      {self.architecture}\n"
            f"  OS:        {self.os_platform}\n"
            f"  Implant:   {self.implant_type}\n"
            f"  Status:    {self.status}\n"
            f"  Age:       {age:.0f}s\n"
            f"  Chain:     {self.chain_name}\n"
        )


# ---------------------------------------------------------------------------
# ExploitFramework core
# ---------------------------------------------------------------------------


class ExploitFramework:
    """Browser exploit framework -- FuzzBunch-style orchestration.

    Provides plugin discovery, parameter validation, sequential chain
    execution, implant session management, and reporting (cf. FuzzBunch).
    """

    BANNER = r"""
   ╔══════════════════════════════════════════════════╗
   ║   Browser Exploit Orchestration Framework        ║
   ║   Staged exploitation pipeline for red team ops  ║
   ╚══════════════════════════════════════════════════╝
    """

    def __init__(self) -> None:
        self.loader = ModuleLoader()
        self.builder: ChainBuilder | None = None
        self.sessions: dict[str, Session] = {}
        self.config: dict[str, Any] = {
            "configs_dir": str(
                Path(__file__).parent / "configs"
            ),
            "log_dir": str(Path(__file__).parent / "logs"),
            "interactive": True,
            "dry_run": False,
            "timeout_multiplier": 1.0,
        }
        self.active_chain: ExploitChain | None = None
        self._initialized = False

    # -------------------------------------------------------------------
    # Initialization
    # -------------------------------------------------------------------

    def initialize(self) -> None:
        """Initialize the framework: load modules, set up chain builder."""
        print(self.BANNER)

        configs_dir = self.config["configs_dir"]
        logger.info("Loading modules from %s", configs_dir)

        count = self.load_modules(configs_dir)
        logger.info(
            "Loaded %d modules, %d chains",
            count,
            len(self.loader.chains),
        )

        if self.loader.load_errors:
            for err in self.loader.load_errors:
                logger.warning("Load error: %s", err)

        self.builder = ChainBuilder(self.loader)
        self._initialized = True

        # Summary
        categories = {}
        for mod in self.loader.modules.values():
            categories[mod.category] = categories.get(mod.category, 0) + 1

        print(f"  Modules loaded: {count}")
        for cat, cnt in sorted(categories.items()):
            print(f"    {cat}: {cnt}")
        print(f"  Chain configs:  {len(self.loader.chains)}")
        print()

    def load_modules(self, path: str) -> int:
        """Load module configs from YAML files (cf. FuzzBunch XML plugin loading).

        Args:
            path: Directory containing YAML module configs.

        Returns:
            Number of modules loaded.
        """
        return self.loader.load_directory(path)

    # -------------------------------------------------------------------
    # Module operations
    # -------------------------------------------------------------------

    def list_modules(self, category: str | None = None) -> list[ModuleConfig]:
        """List available modules by category.

        Categories: recon, exploit, implant, payload, validator
        """
        modules = self.loader.list_modules(category)
        return modules

    def select_module(self, name: str) -> ModuleConfig | None:
        """Select and configure a module (cf. FuzzBunch interactive wizard).

        In non-interactive mode, defaults are applied automatically.

        Args:
            name: Module key (e.g., 'exploit/cve-2026-4698').

        Returns:
            The configured ModuleConfig, or None if not found.
        """
        module = self.loader.get_module(name)
        if module is None:
            logger.error("Module not found: %s", name)
            return None

        print(f"\n{module.summary()}\n")

        if self.config.get("interactive"):
            self._interactive_configure(module)
        else:
            # Apply defaults
            for pname, pdef in module.parameters.items():
                if pdef.default is not None:
                    module.parameter_values[pname] = pdef.default

        # Validate
        errors = module.validate_all_parameters()
        if errors:
            print("Parameter validation errors:")
            for err in errors:
                print(f"  - {err}")
            return None

        return module

    def _interactive_configure(self, module: ModuleConfig) -> None:
        """Interactive parameter wizard (cf. FuzzBunch parameter prompts)."""
        if not module.parameters:
            print("  No configurable parameters.")
            return

        print("Configure parameters (press Enter for default):\n")
        for pname, pdef in module.parameters.items():
            prompt = f"  [{pdef.param_type}] {pname}"
            if pdef.default is not None:
                prompt += f" [{pdef.default}]"
            if pdef.min_val is not None and pdef.max_val is not None:
                prompt += f" ({pdef.min_val}-{pdef.max_val})"
            prompt += ": "

            if pdef.description:
                print(f"    # {pdef.description}")

            try:
                raw = input(prompt).strip()
            except (EOFError, KeyboardInterrupt):
                print("\n  Using defaults for remaining parameters.")
                break

            if not raw:
                # Accept default
                if pdef.default is not None:
                    module.parameter_values[pname] = pdef.default
                continue

            # Parse value
            try:
                if pdef.param_type == "integer":
                    value = int(raw)
                elif pdef.param_type == "float":
                    value = float(raw)
                elif pdef.param_type == "boolean":
                    value = raw.lower() in ("true", "1", "yes", "y")
                else:
                    value = raw
            except ValueError:
                print(f"    Invalid {pdef.param_type} value: {raw}")
                if pdef.default is not None:
                    module.parameter_values[pname] = pdef.default
                    print(f"    Using default: {pdef.default}")
                continue

            ok, msg = pdef.validate(value)
            if ok:
                module.parameter_values[pname] = value
            else:
                print(f"    {msg}")
                if pdef.default is not None:
                    module.parameter_values[pname] = pdef.default
                    print(f"    Using default: {pdef.default}")

    # -------------------------------------------------------------------
    # Target operations
    # -------------------------------------------------------------------

    def validate_target(self, target_config: dict[str, Any]) -> tuple[bool, list[str]]:
        """Pre-flight target validation (cf. FuzzBunch target constraints).

        Checks whether the target configuration matches the requirements
        of the currently selected module or chain.

        Args:
            target_config: Dict with target details (browser, version, etc.).

        Returns:
            (valid, list_of_issues)
        """
        issues = []

        if not target_config.get("browser"):
            issues.append("Target browser not specified")

        if not target_config.get("version"):
            issues.append("Target browser version not determined")

        # If there's an active chain, validate against each stage
        if self.active_chain:
            for stage in self.active_chain.stages:
                ok, stage_issues = self.loader.validate_target_compatibility(
                    stage.module, target_config
                )
                if not ok:
                    issues.extend(
                        f"[{stage.module.name}] {i}" for i in stage_issues
                    )

        return len(issues) == 0, issues

    def touch(self, target: str) -> TouchResult:
        """Non-destructive target probe (cf. Equation Group Smbtouch).

        When an exploit server is configured, serves validator.js to the
        target and collects the fingerprint callback. Otherwise falls back
        to parsing the User-Agent if available.

        Args:
            target: Target URL or host to probe.

        Returns:
            TouchResult with fingerprint data.
        """
        logger.info("Probing target: %s", target)
        print(f"\n[*] Running browser_touch against {target}")
        print("[*] This is a non-destructive probe (Smbtouch equivalent)")

        exploit_server = self.config.get("exploit_server_url")

        if exploit_server:
            # Real mode: check if exploit server has received callbacks
            # from the target with validator results
            print(f"[*] Exploit server at {exploit_server}")
            print(f"[*] Validator available at {exploit_server}/validator.js")
            print(f"[*] Target should load validator.js to fingerprint itself")

            try:
                import requests
                resp = requests.get(f"{exploit_server}/api/callbacks", timeout=5)
                callbacks = resp.json()
                # Look for a validator callback from this target
                for cb in reversed(callbacks):
                    data = cb.get("data", {})
                    if data.get("stage") == "validator":
                        result = TouchResult(
                            browser=data.get("browser", "unknown"),
                            version=data.get("version", "0.0"),
                            engine=data.get("engine", "unknown"),
                            architecture=data.get("arch", "unknown"),
                            os=data.get("os", "unknown"),
                            jit_enabled=data.get("jit_enabled", True),
                            debug_build=data.get("debug_build", False),
                        )
                        print(f"\n[+] Touch results (from validator callback):")
                        self._print_touch(result)
                        return result

                print("[*] No validator callback yet - returning probe URL")
                print(f"    Load in target: {exploit_server}/validator.js")
            except Exception as e:
                logger.warning("Could not reach exploit server: %s", e)

        # Fallback: return unknown (will be populated by manual input or
        # future integration)
        result = TouchResult(
            browser="unknown",
            version="0.0",
            engine="unknown",
            architecture="unknown",
            os="unknown",
            jit_enabled=True,
            debug_build=False,
        )

        print(f"\n[*] Touch results (no validator callback):")
        self._print_touch(result)
        return result

    def _print_touch(self, result: TouchResult) -> None:
        """Print touch results."""
        print(f"    Browser:      {result.browser}")
        print(f"    Version:      {result.version}")
        print(f"    Engine:       {result.engine}")
        print(f"    Architecture: {result.architecture}")
        print(f"    OS:           {result.os}")
        print(f"    JIT enabled:  {result.jit_enabled}")
        print(f"    Debug build:  {result.debug_build}")
        print()

    # -------------------------------------------------------------------
    # Chain operations
    # -------------------------------------------------------------------

    def build_chain(
        self, target_profile: TouchResult | None = None, chain_name: str | None = None
    ) -> ExploitChain | None:
        """Build exploit chain from target profile or named chain config.

        Automates exploit selection (cf. FuzzBunch manual chain assembly)
        by matching touch results against module target specs.

        Args:
            target_profile: TouchResult from a previous touch operation.
            chain_name: Name of a pre-built chain config to use.

        Returns:
            ExploitChain ready for execution, or None on error.
        """
        if self.builder is None:
            logger.error("Framework not initialized. Call initialize() first.")
            return None

        if target_profile is None:
            target_profile = TouchResult()

        chain = self.builder.build_from_touch(target_profile, chain_name)

        # Validate the chain
        valid, issues = self.builder.validate_chain(chain)
        if not valid:
            print("[!] Chain validation issues:")
            for issue in issues:
                print(f"    - {issue}")
        else:
            print("[+] Chain validated successfully")

        self.active_chain = chain
        print(f"\n{chain.summary()}")

        return chain

    def execute_chain(
        self, chain: ExploitChain | None = None, dry_run: bool = False
    ) -> bool:
        """Execute exploit chain with go/no-go gates (cf. FuzzBunch sequential model).

        Each stage must succeed before the next runs. On failure, the framework
        attempts automatic fallback selection when available.

        Args:
            chain: The chain to execute. Uses active_chain if None.
            dry_run: If True, simulate execution without actually running.

        Returns:
            True if chain completed successfully, False otherwise.
        """
        if chain is None:
            chain = self.active_chain
        if chain is None:
            logger.error("No chain to execute. Build a chain first.")
            return False

        mode = "DRY RUN" if dry_run else "LIVE"
        print(f"\n{'=' * 60}")
        print(f"  CHAIN EXECUTION ({mode}): {chain.name}")
        print(f"{'=' * 60}\n")

        chain.status = "running"

        for i, stage in enumerate(chain.stages):
            print(f"\n--- Stage {i + 1}/{len(chain.stages)}: "
                  f"[{stage.stage_type}] {stage.module.name} ---")

            # Go/no-go gate (pre-execution)
            if chain.interactive and not dry_run:
                try:
                    confirm = input(
                        f"\n  [?] Execute {stage.module.name}? [y/N]: "
                    ).strip()
                    if confirm.lower() not in ("y", "yes"):
                        print(f"  [/] Stage skipped by operator")
                        stage.status = "skipped"
                        continue
                except (EOFError, KeyboardInterrupt):
                    print("\n  [!] Chain aborted by operator")
                    chain.status = "aborted"
                    return False

            # Run pre-checks
            print(f"  [*] Running pre-checks...")
            pre_ok = self._run_validation_checks(
                stage.module.pre_checks, dry_run
            )
            if not pre_ok:
                print(f"  [-] Pre-checks failed for {stage.module.name}")
                if stage.gate_fail_msg:
                    print(f"  [!] {stage.gate_fail_msg}")

                # Attempt fallback
                mod_key = f"{stage.module.category}/{stage.module.name}"
                if self.builder and self.builder.apply_fallback(chain, mod_key):
                    print(f"  [*] Fallback applied, retrying stage...")
                    # The stage list has been modified; re-run this index
                    continue

                if chain.abort_on_failure:
                    stage.status = "failed"
                    chain.status = "failed"
                    return False
                else:
                    stage.status = "failed"
                    continue

            # Execute stage
            stage.status = "running"
            if dry_run:
                print(f"  [*] DRY RUN: Would execute {stage.module.name}")
                print(f"      Parameters: {stage.module.get_effective_parameters()}")
                stage.status = "success"
            else:
                print(f"  [*] Executing {stage.module.name}...")
                success = self._execute_stage(stage)
                if not success:
                    print(f"  [-] Stage failed: {stage.module.name}")
                    if stage.gate_fail_msg:
                        print(f"  [!] {stage.gate_fail_msg}")

                    # Attempt fallback
                    mod_key = f"{stage.module.category}/{stage.module.name}"
                    if self.builder and self.builder.apply_fallback(chain, mod_key):
                        print(f"  [*] Fallback applied")
                        continue

                    if chain.abort_on_failure:
                        chain.status = "failed"
                        return False
                    else:
                        stage.status = "failed"
                        continue

            # Run post-checks
            print(f"  [*] Running post-checks...")
            post_ok = self._run_validation_checks(
                stage.module.post_checks, dry_run
            )
            if not post_ok:
                print(f"  [-] Post-checks failed for {stage.module.name}")
                stage.status = "failed"
                if chain.abort_on_failure:
                    chain.status = "failed"
                    return False
                continue

            stage.status = "success"
            if stage.gate_pass_msg:
                print(f"  [+] {stage.gate_pass_msg}")
            print(f"  [+] Stage complete: {stage.module.name}")

            # If this was an implant stage, create a session
            if stage.stage_type == "implant":
                session = self._create_session(chain)
                print(f"  [+] Session established: {session.session_id}")

        chain.status = "complete"
        print(f"\n{'=' * 60}")
        print(f"  CHAIN COMPLETE: {chain.name}")
        print(f"{'=' * 60}\n")

        return True

    def _execute_stage(self, stage: ChainStage) -> bool:
        """Execute a single chain stage.

        When an exploit server is configured, exploit stages serve the
        actual CVE HTML file and wait for a callback. Otherwise falls
        back to simulation.

        Returns True on success, False on failure.
        """
        logger.info(
            "Executing stage: %s (%s)",
            stage.module.name,
            stage.stage_type,
        )

        params = stage.module.get_effective_parameters()
        exploit_server = self.config.get("exploit_server_url")

        # Real exploit delivery via exploit server
        if exploit_server and stage.stage_type == "exploit":
            cve_file = params.get("exploit_file") or params.get("file")
            if cve_file:
                url = f"{exploit_server}/cve/{cve_file}"
                print(f"      [LIVE] Exploit URL: {url}")
                print(f"      [LIVE] Waiting for callback...")
                print(f"      [LIVE] Direct target browser to: {url}")

                # Poll for callback (max 60s)
                try:
                    import requests
                    deadline = time.time() + 60
                    while time.time() < deadline:
                        resp = requests.get(
                            f"{exploit_server}/api/callbacks", timeout=5
                        )
                        callbacks = resp.json()
                        for cb in callbacks:
                            data = cb.get("data", {})
                            if (data.get("cve") == stage.module.name and
                                    cb["time"] > time.time() - 65):
                                print(f"      [+] Callback received!")
                                stage.result = {
                                    "status": "success",
                                    "callback": data,
                                    "timestamp": time.time(),
                                }
                                return True
                        time.sleep(2)
                    print(f"      [-] No callback within 60s timeout")
                    stage.result = {"status": "timeout", "timestamp": time.time()}
                    return False
                except Exception as e:
                    print(f"      [!] Error polling callbacks: {e}")
                    stage.result = {"status": "error", "error": str(e)}
                    return False

        # Recon stage with exploit server - serve validator
        if exploit_server and stage.stage_type == "recon":
            print(f"      [LIVE] Validator: {exploit_server}/validator.js")
            print(f"      [LIVE] Have target load the validator URL")
            stage.result = {"status": "ready", "timestamp": time.time()}
            return True

        # Fallback: simulated execution
        print(f"      [SIM] Stage execution simulated")
        print(f"      [SIM] Module: {stage.module.name}")
        print(f"      [SIM] Type: {stage.stage_type}")
        if params:
            print(f"      [SIM] Parameters:")
            for k, v in params.items():
                print(f"             {k}: {v}")

        stage.result = {"status": "simulated", "timestamp": time.time()}
        return True

    def _run_validation_checks(
        self, checks: list, dry_run: bool
    ) -> bool:
        """Run a list of validation checks."""
        if not checks:
            print(f"      No checks defined -- passing")
            return True

        all_ok = True
        for check in checks:
            if dry_run:
                print(f"      [DRY] Check: {check.name} -- SIMULATED PASS")
                continue

            # Simulated check execution
            # Real implementation would run actual validation logic
            print(f"      [*] Check: {check.name} -- ", end="")
            # All checks pass in simulation
            print("PASS")

        return all_ok

    def _create_session(self, chain: ExploitChain) -> Session:
        """Create a new implant session (cf. DoublePulsar session establishment)."""
        session_id = str(uuid.uuid4())[:8]
        session = Session(
            session_id=session_id,
            target=chain.target_info.get("target", "unknown"),
            browser=chain.target_info.get("browser", "unknown"),
            version=chain.target_info.get("version", "unknown"),
            architecture=chain.target_info.get("arch", "unknown"),
            os_platform=chain.target_info.get("os", "unknown"),
            implant_type="browser-stager",
            established=time.time(),
            last_seen=time.time(),
            status="active",
            chain_name=chain.name,
            capabilities=["survey", "exfil", "execute"],
        )
        self.sessions[session_id] = session
        return session

    # -------------------------------------------------------------------
    # Session operations
    # -------------------------------------------------------------------

    def list_sessions(self) -> list[Session]:
        """List active implant sessions."""
        return list(self.sessions.values())

    def interact_session(self, session_id: str) -> None:
        """Interact with an implant session (cf. FuzzBunch session interaction).

        Simulated. Real implementation would communicate with the
        in-browser stager via the C2 channel.
        """
        session = self.sessions.get(session_id)
        if session is None:
            print(f"[!] Session not found: {session_id}")
            return

        print(f"\n{session.summary()}")
        print("[*] Interactive session (type 'help' for commands, 'exit' to leave)")
        print()

        while True:
            try:
                cmd = input(f"({session_id})> ").strip()
            except (EOFError, KeyboardInterrupt):
                print("\n[*] Exiting session")
                break

            if not cmd:
                continue
            elif cmd == "exit" or cmd == "quit":
                break
            elif cmd == "help":
                print("  help       -- Show this help")
                print("  info       -- Show session info")
                print("  survey     -- Run survey payload")
                print("  exfil      -- Data exfiltration")
                print("  kill       -- Terminate implant")
                print("  exit       -- Leave interaction mode")
            elif cmd == "info":
                print(session.summary())
            elif cmd == "survey":
                print("[*] Running survey payload...")
                print("[SIM] Survey execution simulated")
                session.history.append(
                    {"cmd": "survey", "time": time.time(), "status": "simulated"}
                )
            elif cmd == "exfil":
                print("[*] Data exfiltration...")
                print("[SIM] Exfiltration simulated")
                session.history.append(
                    {"cmd": "exfil", "time": time.time(), "status": "simulated"}
                )
            elif cmd == "kill":
                print("[*] Terminating implant...")
                session.status = "dead"
                print("[+] Implant terminated")
                break
            else:
                print(f"[!] Unknown command: {cmd}")

    # -------------------------------------------------------------------
    # Module info
    # -------------------------------------------------------------------

    def show_module_info(self, name: str) -> None:
        """Display detailed module information."""
        module = self.loader.get_module(name)
        if module is None:
            # Try partial match
            matches = [
                k for k in self.loader.modules
                if name.lower() in k.lower()
            ]
            if matches:
                print(f"[!] Module '{name}' not found. Did you mean:")
                for m in matches:
                    print(f"    {m}")
            else:
                print(f"[!] Module not found: {name}")
            return

        print(f"\n{'=' * 60}")
        print(module.summary())
        print(f"{'=' * 60}")

        if module.description:
            print(f"\nDescription:\n{module.description}")

        if module.notes:
            print(f"Notes:\n{module.notes}")

        if module.parameters:
            print("\nParameters:")
            for pname, pdef in module.parameters.items():
                print(f"  {pname}:")
                print(f"    Type:    {pdef.param_type}")
                print(f"    Default: {pdef.default}")
                if pdef.min_val is not None:
                    print(f"    Min:     {pdef.min_val}")
                if pdef.max_val is not None:
                    print(f"    Max:     {pdef.max_val}")
                if pdef.description:
                    print(f"    Desc:    {pdef.description}")

        if module.pre_checks:
            print("\nPre-checks:")
            for check in module.pre_checks:
                fatal = "FATAL" if check.fatal else "warn"
                print(f"  [{fatal}] {check.name}: {check.description}")

        if module.post_checks:
            print("\nPost-checks:")
            for check in module.post_checks:
                fatal = "FATAL" if check.fatal else "warn"
                print(f"  [{fatal}] {check.name}: {check.description}")

        if module.chain.requires or module.chain.provides or module.chain.chains_to:
            print("\nChain dependencies:")
            if module.chain.requires:
                print(f"  Requires:  {', '.join(module.chain.requires)}")
            if module.chain.provides:
                print(f"  Provides:  {', '.join(module.chain.provides)}")
            if module.chain.chains_to:
                print(f"  Chains to: {', '.join(module.chain.chains_to)}")

        if module.artifacts:
            print("\nArtifacts:")
            for key, val in module.artifacts.items():
                print(f"  {key}: {val}")

        print()


# ---------------------------------------------------------------------------
# CLI interface
# ---------------------------------------------------------------------------


def build_parser() -> argparse.ArgumentParser:
    """Build the argparse CLI parser."""
    parser = argparse.ArgumentParser(
        prog="exploitframework",
        description=(
            "Browser Exploit Orchestration Framework. "
            "Staged exploitation pipeline for red team operations."
        ),
        epilog=(
            "DISCLAIMER: For authorized security research only. "
            "Do not use against systems without explicit written authorization."
        ),
    )
    parser.add_argument(
        "--configs",
        default=None,
        help="Path to module configs directory",
    )
    parser.add_argument(
        "--non-interactive",
        action="store_true",
        help="Disable interactive prompts (use defaults)",
    )
    parser.add_argument(
        "-v", "--verbose",
        action="store_true",
        help="Enable verbose logging",
    )
    parser.add_argument(
        "--exploit-server",
        default=None, metavar="URL",
        help="Exploit server URL (e.g. http://127.0.0.1:9090) for live exploit delivery",
    )

    sub = parser.add_subparsers(dest="command", help="Command to execute")

    # list
    p_list = sub.add_parser("list", help="List available modules")
    p_list.add_argument(
        "--category",
        choices=["recon", "exploit", "implant", "payload", "validator"],
        help="Filter by category",
    )

    # info
    p_info = sub.add_parser("info", help="Show module details")
    p_info.add_argument("module", help="Module key (e.g., exploit/cve-2026-4698)")

    # touch
    p_touch = sub.add_parser(
        "touch",
        help="Non-destructive target probe (Smbtouch equivalent)",
    )
    p_touch.add_argument("--target", required=True, help="Target URL")

    # chain
    p_chain = sub.add_parser("chain", help="Build recommended exploit chain")
    p_chain.add_argument("--target", required=True, help="Target URL")
    p_chain.add_argument("--name", default=None, help="Named chain config to use")

    # run
    p_run = sub.add_parser("run", help="Execute an exploit chain")
    p_run.add_argument("chain_name", help="Chain name or config")
    p_run.add_argument("--target", default=None, help="Target URL")
    p_run.add_argument(
        "--dry-run",
        action="store_true",
        help="Simulate execution without running",
    )

    # sessions
    sub.add_parser("sessions", help="List active implant sessions")

    # interact
    p_interact = sub.add_parser("interact", help="Interact with implant session")
    p_interact.add_argument("session_id", help="Session ID")

    return parser


def main() -> int:
    """Main entry point."""
    parser = build_parser()
    args = parser.parse_args()

    if args.verbose:
        logging.getLogger().setLevel(logging.DEBUG)

    if not args.command:
        parser.print_help()
        return 0

    # Initialize framework
    bb = ExploitFramework()
    if args.configs:
        bb.config["configs_dir"] = args.configs
    if args.non_interactive:
        bb.config["interactive"] = False
    if args.exploit_server:
        bb.config["exploit_server_url"] = args.exploit_server

    bb.initialize()

    # Dispatch command
    if args.command == "list":
        modules = bb.list_modules(args.category)
        if not modules:
            print("[*] No modules found")
        else:
            print(f"\n{'Name':<50} {'Type':<10} {'Version':<10} {'Risk':<8}")
            print("-" * 78)
            for mod in modules:
                key = f"{mod.category}/{mod.name}"
                print(f"{key:<50} {mod.module_type:<10} {mod.version:<10} {mod.risk:<8}")
        return 0

    elif args.command == "info":
        bb.show_module_info(args.module)
        return 0

    elif args.command == "touch":
        result = bb.touch(args.target)
        return 0

    elif args.command == "chain":
        touch_result = bb.touch(args.target)
        chain = bb.build_chain(touch_result, args.name)
        return 0 if chain else 1

    elif args.command == "run":
        # Build chain from named config
        touch = TouchResult()
        if args.target:
            touch = bb.touch(args.target)

        chain = bb.build_chain(touch, args.chain_name)
        if chain is None:
            return 1

        success = bb.execute_chain(chain, dry_run=args.dry_run)
        return 0 if success else 1

    elif args.command == "sessions":
        sessions = bb.list_sessions()
        if not sessions:
            print("[*] No active sessions")
        else:
            print(f"\n{'ID':<10} {'Target':<25} {'Browser':<20} {'Status':<10}")
            print("-" * 65)
            for s in sessions:
                print(
                    f"{s.session_id:<10} {s.target:<25} "
                    f"{s.browser} {s.version:<13} {s.status:<10}"
                )
        return 0

    elif args.command == "interact":
        bb.interact_session(args.session_id)
        return 0

    return 0


if __name__ == "__main__":
    sys.exit(main())