Fix reused Datastore option visibility mutations

[Nayeraneru]

This PR Fixes #21091 to duplicate reused OptBase instances before applying per-container flags, preventing shared options like CHOST, CPORT, and Proxies from changing visibility across modules.

Verification

• bundle exec rspec spec/lib/msf/core/option_container_spec.rb
• Start msfconsole
• use exploit/qnx/qconn/qconn_exec
• run verbose=true rhost=127.0.0.1
• options
• advanced
• The options CHOST, CPORT and Proxies are still advanced options after running the module.

[cdelafuente-r7]

Thank you @Nayeraneru for this fix. I verified using the same workflow from the original issue and it fixes this issue. However, CI specs are failing now. the issue is that now we cannot compare two OptBase objects the same way since they are all different instances. This should be a simple fix and I believe that using #instance_values should solve this.
E.g.
expect(subject.options.instance_values).to eq(expected_options.instance_values)

[cdelafuente-r7]

Thank you @Nayeraneru. Everything looks good now. I do believe more work needs to be done since the mutable constants for common options is not a good idea anyway. But, we will look into this separately.

Example Output

msf exploit(qnx/qconn/qconn_exec) > options

Module options (exploit/qnx/qconn/qconn_exec):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT   8000             yes       The target port (TCP)
   SHELL   /bin/sh          yes       Path to system shell


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf exploit(qnx/qconn/qconn_exec) > advanced

Module advanced options (exploit/qnx/qconn/qconn_exec):

   Name                     Current Setting  Required  Description
   ----                     ---------------  --------  -----------
   AutoCheck                true             no        Run check before exploit
   CHOST                                     no        The local client address
   CPORT                                     no        The local client port
   ConnectTimeout           10               yes       Maximum number of seconds to establish a TCP connection
   ContextInformationFile                    no        The information file that contains context information
   DisablePayloadHandler    false            no        Disable the handler code for the selected payload
   EnableContextEncoding    false            no        Use transient context when encoding payloads
   ForceExploit             false            no        Override check result
   Proxies                                   no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, http, socks4, socks5, socks5h
   SSL                      false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                                 no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLKeyLogFile                             no        The SSL key log file
   SSLServerNameIndication                   no        SSL/TLS Server Name Indication (SNI)
   SSLVerifyMode            PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion               Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   VERBOSE                  false            no        Enable detailed status messages
   WORKSPACE                                 no        Specify the workspace for this module
   WfsDelay                 10               no        Additional delay in seconds to wait for a session


Payload advanced options (cmd/unix/interact):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   AutoVerifySession           true             yes       Automatically verify and drop invalid sessions
   CommandShellCleanupCommand                   no        A command to run before the session is closed
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module


View the full module info with the info, or info -d command.

msf exploit(qnx/qconn/qconn_exec) > run verbose=true rhost=127.0.0.1
[*] 127.0.0.1:8000 - Running automatic check ("set AutoCheck false" to disable)
[*] 127.0.0.1:8000 - Sending check...
[-] 127.0.0.1:8000 - Exploit failed [unreachable]: Rex::ConnectionRefused The connection was refused by the remote host (127.0.0.1:8000).
[*] Exploit completed, but no session was created.
msf exploit(qnx/qconn/qconn_exec) > options

Module options (exploit/qnx/qconn/qconn_exec):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT   8000             yes       The target port (TCP)
   SHELL   /bin/sh          yes       Path to system shell


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf exploit(qnx/qconn/qconn_exec) > advanced

Module advanced options (exploit/qnx/qconn/qconn_exec):

   Name                     Current Setting  Required  Description
   ----                     ---------------  --------  -----------
   AutoCheck                true             no        Run check before exploit
   CHOST                                     no        The local client address
   CPORT                                     no        The local client port
   ConnectTimeout           10               yes       Maximum number of seconds to establish a TCP connection
   ContextInformationFile                    no        The information file that contains context information
   DisablePayloadHandler    false            no        Disable the handler code for the selected payload
   EnableContextEncoding    false            no        Use transient context when encoding payloads
   ForceExploit             false            no        Override check result
   Proxies                                   no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, http, socks4, socks5, socks5h
   SSL                      false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                                 no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLKeyLogFile                             no        The SSL key log file
   SSLServerNameIndication                   no        SSL/TLS Server Name Indication (SNI)
   SSLVerifyMode            PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion               Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   VERBOSE                  false            no        Enable detailed status messages
   WORKSPACE                                 no        Specify the workspace for this module
   WfsDelay                 10               no        Additional delay in seconds to wait for a session


Payload advanced options (cmd/unix/interact):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   AutoVerifySession           true             yes       Automatically verify and drop invalid sessions
   CommandShellCleanupCommand                   no        A command to run before the session is closed
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module


View the full module info with the info, or info -d command.