rapid7/metasploit-framework

View on GitHub

Showing 22,177 of 22,177 total issues

File vim_soap.rb has 597 lines of code (exceeds 250 allowed). Consider refactoring.
Open

module Msf

module Exploit::Remote::VIMSoap
  include Msf::Exploit::Remote::HttpClient

Severity: Major
Found in lib/msf/core/exploit/remote/vim_soap.rb - About 1 day to fix

    File auth_brute.rb has 595 lines of code (exceeds 250 allowed). Consider refactoring.
    Open

    module Msf
    
    ###
    #
    # This module provides methods for brute forcing authentication
    Severity: Major
    Found in lib/msf/core/auxiliary/auth_brute.rb - About 1 day to fix

      File utils.rb has 587 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      module Rex::Proto::NTLM
        class Utils
      
          # duplicate from lib/rex/proto/smb/utils cause we only need this function from Rex::Proto::SMB::Utils
          # Convert a unix timestamp to a 64-bit signed server time
      Severity: Major
      Found in lib/rex/proto/ntlm/utils.rb - About 1 day to fix

        File http_client.rb has 587 lines of code (exceeds 250 allowed). Consider refactoring.
        Open

        require 'uri'
        require 'digest'
        
        module Msf
        
        
        Severity: Major
        Found in lib/msf/core/exploit/remote/http_client.rb - About 1 day to fix

          Method run has a Cognitive Complexity of 64 (exceeds 5 allowed). Consider refactoring.
          Open

            def run
              # check if we already have a socket, if not, create one
              unless @sock
                # create a socket
                res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
          Severity: Minor
          Found in modules/auxiliary/gather/manageengine_datasecurity_plus_xnode_enum.rb - About 1 day to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method run has a Cognitive Complexity of 64 (exceeds 5 allowed). Consider refactoring.
          Open

            def run
              # check if we already have a socket, if not, create one
              unless @sock
                # create a socket
                res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
          Severity: Minor
          Found in modules/auxiliary/gather/manageengine_adaudit_plus_xnode_enum.rb - About 1 day to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method run has a Cognitive Complexity of 64 (exceeds 5 allowed). Consider refactoring.
          Open

            def run
              base_addr = datastore['BASEDNS']
              targ_addr = datastore['TARGDNS']
              check_ar  = datastore['CHECK_ADDITIONAL']
              check_aa  = datastore['CHECK_AUTHORITY']
          Severity: Minor
          Found in modules/auxiliary/spoof/dns/compare_results.rb - About 1 day to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method run_host has a Cognitive Complexity of 64 (exceeds 5 allowed). Consider refactoring.
          Open

            def run_host(target_host)
              print_status("Trying #{target_host}")
              if wordpress_and_online?
                version = wordpress_version
                version_string = version || '(no version detected)'
          Severity: Minor
          Found in modules/auxiliary/scanner/http/wordpress_scanner.rb - About 1 day to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method initialize has a Cognitive Complexity of 64 (exceeds 5 allowed). Consider refactoring.
          Open

            def initialize(framework)
              self.framework = framework
              self.sid_pool  = 0
              self.mutex = Mutex.new
              self.scheduler_queue = ::Queue.new
          Severity: Minor
          Found in lib/msf/core/session_manager.rb - About 1 day to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method on_request_uri has 252 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def on_request_uri(cli, request)
              print_status("Sending #{request.uri} to #{request['User-Agent']}")
              escaped_payload = Rex::Text.to_unescape(payload.raw)
              jscript = %Q^
          var shellcode = unescape("#{escaped_payload}");
          Severity: Major
          Found in modules/exploits/multi/browser/chrome_jscreate_sideeffect.rb - About 1 day to fix

            File crushftp_rce_cve_2023_43177.rb has 585 lines of code (exceeds 250 allowed). Consider refactoring.
            Open

            class MetasploitModule < Msf::Exploit::Remote
              Rank = ExcellentRanking
            
              include Msf::Exploit::Remote::HttpClient
              include Msf::Exploit::FileDropper
            Severity: Major
            Found in modules/exploits/multi/http/crushftp_rce_cve_2023_43177.rb - About 1 day to fix

              Method on_request_uri has 249 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def on_request_uri(cli, request)
                  print_status("Sending #{request.uri} to #{request['User-Agent']}")
                  download_payload = ''
                  shellcode = payload.encoded
                  uripath = datastore['URIPATH'] || get_resource
              Severity: Major
              Found in modules/exploits/multi/browser/chrome_object_create.rb - About 1 day to fix

                File cloud_lookup.rb has 580 lines of code (exceeds 250 allowed). Consider refactoring.
                Open

                require 'public_suffix'
                
                class MetasploitModule < Msf::Auxiliary
                  include Msf::Exploit::Remote::DNS::Enumeration
                  include Msf::Auxiliary::Report
                Severity: Major
                Found in modules/auxiliary/gather/cloud_lookup.rb - About 1 day to fix

                  File firefox_creds.rb has 580 lines of code (exceeds 250 allowed). Consider refactoring.
                  Open

                  require 'tmpdir'
                  
                  #
                  # Gems
                  #
                  Severity: Major
                  Found in modules/post/multi/gather/firefox_creds.rb - About 1 day to fix

                    Function main has a Cognitive Complexity of 63 (exceeds 5 allowed). Consider refactoring.
                    Open

                    def main(argv=None):
                        if not argv:
                            argv = sys.argv
                            if len(argv) == 1:
                                print('Usage: build.py [clean|all|<name>]')
                    Severity: Minor
                    Found in external/source/shellcode/windows/x86/build.py - About 1 day to fix

                    Cognitive Complexity

                    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                    A method's cognitive complexity is based on a few simple rules:

                    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                    • Code is considered more complex for each "break in the linear flow of the code"
                    • Code is considered more complex when "flow breaking structures are nested"

                    Further reading

                    Method create_lm_ntlm_responses has a Cognitive Complexity of 63 (exceeds 5 allowed). Consider refactoring.
                    Open

                        def self.create_lm_ntlm_responses(user, pass, challenge_key, domain = '', default_name = '', default_domain = '',
                                dns_host_name = '', dns_domain_name = '', chall_MsvAvTimestamp = nil, spnopt = {}, opt = {} )
                    
                          usentlm2_session     = opt[:usentlm2_session]    != nil ? opt[:usentlm2_session] : true
                          use_ntlmv2         = opt[:use_ntlmv2]         != nil ? opt[:use_ntlmv2] : false
                    Severity: Minor
                    Found in lib/rex/proto/ntlm/utils.rb - About 1 day to fix

                    Cognitive Complexity

                    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                    A method's cognitive complexity is based on a few simple rules:

                    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                    • Code is considered more complex for each "break in the linear flow of the code"
                    • Code is considered more complex when "flow breaking structures are nested"

                    Further reading

                    Method cmd_transport has a Cognitive Complexity of 63 (exceeds 5 allowed). Consider refactoring.
                    Open

                      def cmd_transport(*args)
                        if ( args.length == 0 or args.include?("-h") )
                          cmd_transport_help
                          return
                        end
                    Severity: Minor
                    Found in lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb - About 1 day to fix

                    Cognitive Complexity

                    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                    A method's cognitive complexity is based on a few simple rules:

                    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                    • Code is considered more complex for each "break in the linear flow of the code"
                    • Code is considered more complex when "flow breaking structures are nested"

                    Further reading

                    Method monitor_socket has a Cognitive Complexity of 63 (exceeds 5 allowed). Consider refactoring.
                    Open

                      def monitor_socket
                    
                        # Skip if we are using a passive dispatcher
                        return if self.passive_service
                    
                    
                    Severity: Minor
                    Found in lib/rex/post/meterpreter/packet_dispatcher.rb - About 1 day to fix

                    Cognitive Complexity

                    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                    A method's cognitive complexity is based on a few simple rules:

                    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                    • Code is considered more complex for each "break in the linear flow of the code"
                    • Code is considered more complex when "flow breaking structures are nested"

                    Further reading

                    Method command_string has 247 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def command_string
                        if (datastore['JOBNAME'] == "DUMMY") && !datastore['FTPUSER'].nil?
                          datastore['JOBNAME'] = (datastore['FTPUSER'] + "1").strip.upcase
                        end
                        lhost = Rex::Socket.resolv_nbo(datastore['LHOST'])
                    Severity: Major
                    Found in modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb - About 1 day to fix

                      Method osx_capture_media has 247 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def osx_capture_media(opts)
                          capture_code = <<-EOS
                      #{osx_ruby_dl_header}
                      
                      options = {
                      Severity: Major
                      Found in lib/msf/core/post/osx/ruby_dl.rb - About 1 day to fix
                        Severity
                        Category
                        Status
                        Source
                        Language