rapid7/metasploit-framework

View on GitHub

Showing 7,301 of 22,004 total issues

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  def check
    targ = rhost

    srv_sock = Rex::Socket.create_udp(
      'PeerHost' => targ,
Severity: Major
Found in modules/auxiliary/spoof/dns/bailiwicked_host.rb and 1 other location - About 6 hrs to fix
modules/auxiliary/spoof/dns/bailiwicked_domain.rb on lines 75..150

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 218.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Method mssql_get_hash has 167 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def mssql_get_hash(arg = {})
    ntlm_ver = arg[:ntlm_ver]
    if ntlm_ver == NTLM_CONST::NTLM_V1_RESPONSE or ntlm_ver == NTLM_CONST::NTLM_2_SESSION_RESPONSE
      lm_hash = arg[:lm_hash]
      nt_hash = arg[:nt_hash]
Severity: Major
Found in modules/auxiliary/server/capture/mssql.rb - About 6 hrs to fix

    Method run has 167 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def run
        unless db
          print_warning('Cannot find any active database. Extracted data will only be displayed here and NOT stored.')
        end
    
    
    Severity: Major
    Found in modules/auxiliary/gather/windows_secrets_dump.rb - About 6 hrs to fix

      Method output_endpoint_data has 167 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def output_endpoint_data(r)
          ssl_protocols = [
            { id: 771, name: "TLS", version: "1.2", secure: true, active: false },
            { id: 770, name: "TLS", version: "1.1", secure: true, active: false },
            { id: 769, name: "TLS", version: "1.0", secure: true, active: false },
      Severity: Major
      Found in modules/auxiliary/gather/ssllabs_scan.rb - About 6 hrs to fix

        Method check_vulnerabilities has 167 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def check_vulnerabilities(ip, ssl_version, ssl_cipher, cert)
            # POODLE
            if ssl_version == 'SSLv3'
              print_good('Accepts SSLv3, vulnerable to POODLE')
              report_vuln(
        Severity: Major
        Found in modules/auxiliary/scanner/ssl/ssl_version.rb - About 6 hrs to fix

          Identical blocks of code found in 2 locations. Consider refactoring.
          Open

            def build_dgc_clean_args(jar_url)
              arguments = []
          
              new_array_annotation = Rex::Java::Serialization::Model::Annotation.new
              new_array_annotation.contents = [
          Severity: Major
          Found in modules/auxiliary/scanner/misc/java_rmi_server.rb and 1 other location - About 6 hrs to fix
          modules/exploits/multi/misc/java_rmi_server.rb on lines 226..279

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 217.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Identical blocks of code found in 2 locations. Consider refactoring.
          Open

            def build_dgc_clean_args(jar_url)
              arguments = []
          
              new_array_annotation = Rex::Java::Serialization::Model::Annotation.new
              new_array_annotation.contents = [
          Severity: Major
          Found in modules/exploits/multi/misc/java_rmi_server.rb and 1 other location - About 6 hrs to fix
          modules/auxiliary/scanner/misc/java_rmi_server.rb on lines 125..183

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 217.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Method vuln_version? has 166 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def vuln_version?(res)
              # checks the model, firmware and hardware version
              @d_link = { 'product' => nil, 'firmware' => nil, 'hardware' => nil, 'arch' => nil }
              html = Nokogiri.HTML(res.body, nil, 'UTF-8')
          
          
          Severity: Major
          Found in modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb - About 6 hrs to fix

            Method mssql_parse_tds_row has 165 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def mssql_parse_tds_row(data, info)
                info[:rows] ||= []
                row = []
            
                info[:colinfos].each do |col|
            Severity: Major
            Found in lib/rex/proto/mssql/client_mixin.rb - About 6 hrs to fix

              Method initialize has 165 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def initialize(info = {})
                  super(update_info(info,
                    'Name'          => 'Windows Inject DLL',
                    'Description'   => 'Inject a custom DLL into the exploited process',
                    'Author'        =>
              Severity: Major
              Found in lib/msf/core/payload/windows/dll_inject.rb - About 6 hrs to fix

                Method cmd_notes has 164 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def cmd_notes(*args)
                    return unless active?
                  ::ApplicationRecord.connection_pool.with_connection {
                    mode = :search
                    data = nil
                Severity: Major
                Found in lib/msf/ui/console/command_dispatcher/db.rb - About 6 hrs to fix

                  Method run_host has 163 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def run_host(target_host)
                      conn = true
                      ecode = nil
                      emesg = nil
                  
                  
                  Severity: Major
                  Found in modules/auxiliary/scanner/http/svn_scanner.rb - About 6 hrs to fix

                    Method initialize has 163 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def initialize
                        super(
                          'Name'             => 'SSH User Code Execution',
                          'Description'      => %q(
                            This module connects to the target system and executes the necessary
                    Severity: Major
                    Found in modules/exploits/multi/ssh/sshexec.rb - About 6 hrs to fix

                      Method cmd_portfwd has 162 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def cmd_portfwd(*args)
                          args.unshift('list') if args.empty?
                      
                          # For clarity's sake.
                          lport = nil
                      Severity: Major
                      Found in lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb - About 6 hrs to fix

                        Method netsparker_vulnerability_map has 162 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def netsparker_vulnerability_map(vuln)
                            res = {
                              :risk => 1,
                              :name  => 'Information Disclosure',
                              :blame => 'System Administrator',
                        Severity: Major
                        Found in lib/msf/core/db_manager/import/netsparker.rb - About 6 hrs to fix

                          Method backdoor_apk has 162 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def backdoor_apk(apkfile, raw_payload, signature = true, manifest = true, apk_data = nil, service = true)
                              unless apk_data || apkfile && File.readable?(apkfile)
                                usage
                                raise RuntimeError, "Invalid template: #{apkfile}"
                              end
                          Severity: Major
                          Found in lib/msf/core/payload/apk.rb - About 6 hrs to fix

                            Method run has 161 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def run
                            
                                print_status("Trying to find the service desk service strong name...")
                                service_desk = get_service_desk_strong_name
                                if service_desk.nil?
                            Severity: Major
                            Found in modules/auxiliary/admin/hp/hp_imc_som_create_account.rb - About 6 hrs to fix

                              Method execute_command has 161 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def execute_command(cmd, _opts = {})
                                  # Get the user's inbox folder's ID and change key ID.
                                  print_status("Getting the user's inbox folder's ID and ChangeKey ID...")
                                  xml_getfolder_inbox = %(<?xml version="1.0" encoding="utf-8"?>
                                  <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">

                                Method initialize has 161 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def initialize(info = {})
                                    super(
                                      update_info(
                                        info,
                                        'Name' => 'Docker Container Escape Via runC Overwrite',
                                Severity: Major
                                Found in modules/exploits/linux/local/docker_runc_escape.rb - About 6 hrs to fix

                                  Method run has 161 lines of code (exceeds 25 allowed). Consider refactoring.
                                  Open

                                    def run
                                      print_status("Upgrading session ID: #{datastore['SESSION']}")
                                  
                                      # Try hard to find a valid LHOST value in order to
                                      # make running 'sessions -u' as robust as possible.
                                  Severity: Major
                                  Found in modules/post/multi/manage/shell_to_meterpreter.rb - About 6 hrs to fix
                                    Severity
                                    Category
                                    Status
                                    Source
                                    Language