Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 7,361 of 22,177 total issues

Similar blocks of code found in 5 locations. Consider refactoring.
Open

    sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
Severity: Major
Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
modules/auxiliary/client/iec104/iec104.rb on lines 229..247
modules/auxiliary/client/iec104/iec104.rb on lines 348..366
modules/auxiliary/client/iec104/iec104.rb on lines 371..389
modules/auxiliary/client/iec104/iec104.rb on lines 394..412

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 149.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 5 locations. Consider refactoring.
Open

    sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
Severity: Major
Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
modules/auxiliary/client/iec104/iec104.rb on lines 229..247
modules/auxiliary/client/iec104/iec104.rb on lines 325..343
modules/auxiliary/client/iec104/iec104.rb on lines 348..366
modules/auxiliary/client/iec104/iec104.rb on lines 371..389

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 149.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 3 locations. Consider refactoring.
Open

        custom_js = <<-JS
        #{js_element_name} = document.getElementById("d");
        #{js_element_name}.QueryInterface(Components.interfaces.nsIChannelEventSink).onChannelRedirect(null,new Object,0)

        #{js_obj_addr_name} = unescape("\x00#{fakevtable}");
Severity: Major
Found in modules/exploits/windows/browser/mozilla_mchannel.rb and 2 other locations - About 4 hrs to fix
modules/exploits/windows/browser/realplayer_console.rb on lines 85..104
modules/exploits/windows/fileformat/adobe_geticon.rb on lines 92..109

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 149.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 3 locations. Consider refactoring.
Open

<object classid='clsid:2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93' id='#{racontrol}'></object>
<script language='javascript'>
#{j_shellcode} = unescape('#{shellcode}');
#{randnop} = "#{nops}";
#{j_nops} = unescape(#{randnop});
Severity: Major
Found in modules/exploits/windows/browser/realplayer_console.rb and 2 other locations - About 4 hrs to fix
modules/exploits/windows/browser/mozilla_mchannel.rb on lines 287..320
modules/exploits/windows/fileformat/adobe_geticon.rb on lines 92..109

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 149.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 3 locations. Consider refactoring.
Open

    script = %Q|
    var #{rand1} = unescape("#{shellcode}");
    var #{rand2} ="";
    for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape("#{nops}");
    #{rand4} = #{rand2} + #{rand1};
Severity: Major
Found in modules/exploits/windows/fileformat/adobe_geticon.rb and 2 other locations - About 4 hrs to fix
modules/exploits/windows/browser/mozilla_mchannel.rb on lines 287..320
modules/exploits/windows/browser/realplayer_console.rb on lines 85..104

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 149.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Method crawler_process_page has 109 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def crawler_process_page(t, page, cnt)
    return if page.nil? # Skip over pages that don't contain any info aka page is nil. We can't process these types of pages since there is no data to process.
    msg = "[#{"%.5d" % cnt}/#{"%.5d" % max_page_count}]    #{page ? page.code || "ERR" : "ERR"} - #{t[:vhost]} - #{page.url}"
    if page.error
      print_error("Error accessing page #{page.error.to_s}")
Severity: Major
Found in modules/auxiliary/scanner/http/crawler.rb - About 4 hrs to fix

    Method stage2_html has 109 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def stage2_html(req_uri)

    template = <<-EOF
    <html>
    <head>
    Severity: Major
    Found in modules/exploits/windows/browser/ms16_051_vbscript.rb - About 4 hrs to fix

      Method make_js has 109 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def make_js(encoded_payload)

    # The following executes a ret2lib using icucnv36.dll
    # The effect is to bypass DEP and execute the shellcode in an indirect way
    stack_data = [
      Severity: Major
      Found in modules/exploits/windows/browser/adobe_cooltype_sing.rb - About 4 hrs to fix

        Method make_js has 109 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def make_js(encoded_payload)

    # The following executes a ret2lib using icucnv36.dll
    # The effect is to bypass DEP and execute the shellcode in an indirect way
    stack_data = [
        Severity: Major
        Found in modules/exploits/windows/fileformat/adobe_cooltype_sing.rb - About 4 hrs to fix

          Method system_v has 109 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def system_v(backdoor_path, backdoor_file, runlevel, has_updatercd)
    if has_updatercd
      print_status('Utilizing update-rc.d')
    else
      print_status('Utilizing chkconfig')
          Severity: Major
          Found in modules/exploits/linux/local/service_persistence.rb - About 4 hrs to fix

            Method parse_decrypted_cache has 109 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def parse_decrypted_cache(dec_data, s)
    i = 0
    hash = dec_data[i, 0x10]
    i += 72
            Severity: Major
            Found in modules/post/windows/gather/cachedump.rb - About 4 hrs to fix

              Method session_setup_with_ntlmssp has 109 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def session_setup_with_ntlmssp(user = '', pass = '', domain = '', name = nil, do_recv = true)

    ntlm_options = {
        :signing          => self.require_signing,
        :usentlm2_session => self.usentlm2_session,
              Severity: Major
              Found in lib/rex/proto/smb/client.rb - About 4 hrs to fix

                Similar blocks of code found in 2 locations. Consider refactoring.
                Open

                  def initialize(info = {})
    super(merge_info(info,
      'Name'          => 'Linux Command Shell, Bind TCP Inline',
      'Description'   => 'Listen for a connection and spawn a command shell',
      'Author'        => 'Ramon de C Valle',
                Severity: Major
                Found in modules/payloads/singles/linux/ppc64/shell_bind_tcp.rb and 1 other location - About 4 hrs to fix
                modules/payloads/singles/linux/ppc/shell_bind_tcp.rb on lines 15..88

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 148.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Similar blocks of code found in 2 locations. Consider refactoring.
                Open

                  def initialize(info = {})
    super(merge_info(info,
      'Name'          => 'Linux Command Shell, Bind TCP Inline',
      'Description'   => 'Listen for a connection and spawn a command shell',
      'Author'        => 'Ramon de C Valle',
                Severity: Major
                Found in modules/payloads/singles/linux/ppc/shell_bind_tcp.rb and 1 other location - About 4 hrs to fix
                modules/payloads/singles/linux/ppc64/shell_bind_tcp.rb on lines 15..88

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 148.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Method run_host has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def run_host(ip)
    conn = false
    usecode = datastore['ForceCode']

    tpath = normalize_uri(datastore['PATH'])
                Severity: Major
                Found in modules/auxiliary/scanner/http/web_vulndb.rb - About 4 hrs to fix

                  Method execute_command has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def execute_command(cmd, _opts = {})
    # OpenMediaFault current release - v6.0.15-1 uses an array definition ['*']
    # OpenMediaVault v3.0.16 - v6.0.14-1 uses a string definition '*'
    # OpenMediaVault v1.0.22 - v3.0.15 uses a string definition '*' and uuid setting 'undefined'
    # OpenMediaVault v0.2.6.4 - v1.0.31 uses a string definition '*' and uuid setting 'undefined' and no execution parameter
                  Severity: Major
                  Found in modules/exploits/unix/webapp/openmediavault_auth_cron_rce.rb - About 4 hrs to fix

                    Method exploit has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def exploit
    unless datastore['AutoCheck']
      cookie_jar.clear
      res = authenticate
      fail_with(Failure::NoAccess, 'Authentication failed') if res&.body =~ %r{<title>ZM - Login</title>}
                    Severity: Major
                    Found in modules/exploits/unix/webapp/zoneminder_lang_exec.rb - About 4 hrs to fix

                      Method initialize has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Gibbon School Platform Authenticated PHP Deserialization Vulnerability',
                      Severity: Major
                      Found in modules/exploits/multi/http/gibbon_auth_rce_cve_2024_24725.rb - About 4 hrs to fix

                        Method initialize has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.',
                        Severity: Major
                        Found in modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb - About 4 hrs to fix

                          Method report_vuln has 108 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def report_vuln(opts)
    return if not active
    raise ArgumentError.new("Missing required option :host") if opts[:host].nil?
    raise ArgumentError.new("Deprecated data column for vuln, use .info instead") if opts[:data]
    name = opts[:name] || return
                          Severity: Major
                          Found in lib/msf/core/db_manager/vuln.rb - About 4 hrs to fix
                            Severity
                            Category
                            Status
                            Source
                            Language