Add stdin support for modules

[vognik]

Summary

Sometimes static values from datastore are not enough.
For example, when target services enforces 2FA.

It can be useful to add a function for user input at runtime.

Basic example

Ghost CMS enforces 2FA by default, and you cannot log in without a code from an email #21234

In code, it could be useful to use a function that asks the user for a 2FA code at runtime.

res = ghost_request_cgi('POST', 'session', data: {
  username: datastore['USERNAME'],
  password: datastore['PASSWORD']
})

if res&.code == 201
  print_good('Session established via password.')

elsif res&.body =~ /2FA_NEW_DEVICE_DETECTED/
  print_warning('Ghost CMS requires a 6-digit verification code from your email.')

  verification_code = input('[*] Enter the 6-digit verification code: ', format: '[0-9]{6}') // <= a new function for user input

  print_status("Verifying session with code: #{verification_code}...")
  res_verify = ghost_request_cgi('PUT', 'session/verify', data: {
    token: verification_code
  })

end

Motivation

Metasploit does not support runtime input, and because of this, you cannot create exploits for some systems.

[smcintyre-r7]

Is there a reason that the OTP can't be specified using the datastore at module run time? Perhaps you'd have a module action like 'SEND_OTP' then the main action would use the code.

[vognik]

Is there a reason that the OTP can't be specified using the datastore at module run time? Perhaps you'd have a module action like 'SEND_OTP' then the main action would use the code.

Not really convenient if TOTP lives only 30 sec as it recommends in the official spec https://datatracker.ietf.org/doc/html/rfc6238#:~:text=We%20RECOMMEND%20a%20default%20time%2Dstep%20size%20of%2030%20seconds.

In my case, your suggestion works. However, the TOTP is tied to the session, which doesn't persist between runs. I could also save the cookie in the datastore, but that feels a bit kludgy for me (I might be wrong though)

[smcintyre-r7]

Let me frame it this way: doing what you're proposing would be a lot of work for all of the RPC based Metasploit runners, pretty much everything but msfconsole. Those wouldn't have access to a reasonable stdin stream to read from and RPC callers would need to poll for input or have some other kind of event based system. In order to justify the investment needed to ensure that all runners are still capable of leveraging the module, we'd need to have a pretty extensive use case.