Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 7,266 of 21,886 total issues

File mssql_enum.rb has 734 lines of code (exceeds 250 allowed). Consider refactoring.
Open

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::MSSQL
  include Msf::Auxiliary::Report
  include Msf::OptionalSession::MSSQL
Severity: Major
Found in modules/auxiliary/admin/mssql/mssql_enum.rb - About 1 day to fix

    Method sql_statement has 340 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def sql_statement()

    # DEFINED HEADER TEXT
    headings = [
      ["Server","Database", "Schema", "Table", "Column", "Data Type", "Sample Data","Row Count"]
    Severity: Major
    Found in modules/auxiliary/admin/mssql/mssql_findandsampledata.rb - About 1 day to fix

      File ssllabs_scan.rb has 732 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      require 'active_support/inflector'
require 'json'
require 'active_support/core_ext/hash'

class MetasploitModule < Msf::Auxiliary
      Severity: Major
      Found in modules/auxiliary/gather/ssllabs_scan.rb - About 1 day to fix

        File readable_text.rb has 731 lines of code (exceeds 250 allowed). Consider refactoring.
        Open

        module Msf
module Serializer

# This class formats information in a plain-text format that
# is meant to be displayed on a console or some other non-GUI
        Severity: Major
        Found in lib/msf/base/serializer/readable_text.rb - About 1 day to fix

          File weblogic_deserialize_badattrval.rb has 728 lines of code (exceeds 250 allowed). Consider refactoring.
          Open

          class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager
          Severity: Major
          Found in modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb - About 1 day to fix

            Similar blocks of code found in 2 locations. Consider refactoring.
            Open

              def exploit
    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
    uri = '/apply.cgi'
    user = datastore['HttpUsername']
    pass = datastore['HttpPassword']
            Severity: Major
            Found in modules/exploits/linux/http/linksys_e1500_apply_exec.rb and 1 other location - About 1 day to fix
            modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb on lines 102..224

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 420.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Similar blocks of code found in 2 locations. Consider refactoring.
            Open

              def exploit
    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
    uri = '/setup.cgi'
    user = datastore['HttpUsername']
    pass = datastore['HttpPassword']
            Severity: Major
            Found in modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb and 1 other location - About 1 day to fix
            modules/exploits/linux/http/linksys_e1500_apply_exec.rb on lines 98..220

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 420.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            File veeam_credential_dump.rb has 724 lines of code (exceeds 250 allowed). Consider refactoring.
            Open

            require 'metasploit/framework/credential_collection'

class MetasploitModule < Msf::Post
  include Msf::Post::Common
  include Msf::Post::File
            Severity: Major
            Found in modules/post/windows/gather/credentials/veeam_credential_dump.rb - About 1 day to fix

              Method on_request_uri has 334 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def on_request_uri(cli, request)
    print_status("Sending #{request.uri}")
    if request.uri =~ %r{/exploit.html$}
      html = %Q^
<html>
              Severity: Major
              Found in modules/exploits/windows/browser/chrome_filereader_uaf.rb - About 1 day to fix

                Class Core has 88 methods (exceeds 20 allowed). Consider refactoring.
                Open

                class Core

  include Msf::Ui::Console::CommandDispatcher
  include Msf::Ui::Console::CommandDispatcher::Common
  include Msf::Ui::Console::ModuleOptionTabCompletion
                Severity: Major
                Found in lib/msf/ui/console/command_dispatcher/core.rb - About 1 day to fix

                  File java_jdwp_debugger.rb has 718 lines of code (exceeds 250 allowed). Consider refactoring.
                  Open

                  class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::EXE
                  Severity: Major
                  Found in modules/exploits/multi/misc/java_jdwp_debugger.rb - About 1 day to fix

                    Method exploit has 329 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def exploit
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && res.code != 301
                    Severity: Major
                    Found in modules/exploits/linux/http/php_imap_open_rce.rb - About 1 day to fix

                      Identical blocks of code found in 3 locations. Consider refactoring.
                      Open

                        def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                      Severity: Major
                      Found in modules/encoders/x86/context_time.rb and 2 other locations - About 1 day to fix
                      modules/encoders/x86/context_cpuid.rb on lines 118..194
                      modules/encoders/x86/context_stat.rb on lines 122..197

                      Duplicated Code

                      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                      Tuning

                      This issue has a mass of 409.

                      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                      Refactorings

                      Further Reading

                      Identical blocks of code found in 3 locations. Consider refactoring.
                      Open

                        def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                      Severity: Major
                      Found in modules/encoders/x86/context_cpuid.rb and 2 other locations - About 1 day to fix
                      modules/encoders/x86/context_stat.rb on lines 122..197
                      modules/encoders/x86/context_time.rb on lines 108..183

                      Duplicated Code

                      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                      Tuning

                      This issue has a mass of 409.

                      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                      Refactorings

                      Further Reading

                      Identical blocks of code found in 3 locations. Consider refactoring.
                      Open

                        def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                      Severity: Major
                      Found in modules/encoders/x86/context_stat.rb and 2 other locations - About 1 day to fix
                      modules/encoders/x86/context_cpuid.rb on lines 118..194
                      modules/encoders/x86/context_time.rb on lines 108..183

                      Duplicated Code

                      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                      Tuning

                      This issue has a mass of 409.

                      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                      Refactorings

                      Further Reading

                      Method exploit has 326 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def exploit
    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end
                      Severity: Major
                      Found in modules/exploits/solaris/local/rsh_stack_clash_priv_esc.rb - About 1 day to fix

                        Identical blocks of code found in 2 locations. Consider refactoring.
                        Open

                        def check_nsswitch():
    idx = 0
    found_passwd = False
    with open('/etc/nsswitch.conf', 'r') as f:
        for line in f:
                        Severity: Major
                        Found in data/exploits/CVE-2021-3156/nss_u16.py and 1 other location - About 1 day to fix
                        data/exploits/CVE-2021-3156/nss_u14.py on lines 40..65

                        Duplicated Code

                        Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                        Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                        When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                        Tuning

                        This issue has a mass of 182.

                        We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                        The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                        If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                        See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                        Refactorings

                        Further Reading

                        Identical blocks of code found in 2 locations. Consider refactoring.
                        Open

                        def check_nsswitch():
    idx = 0
    found_passwd = False
    with open('/etc/nsswitch.conf', 'r') as f:
        for line in f:
                        Severity: Major
                        Found in data/exploits/CVE-2021-3156/nss_u14.py and 1 other location - About 1 day to fix
                        data/exploits/CVE-2021-3156/nss_u16.py on lines 38..63

                        Duplicated Code

                        Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                        Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                        When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                        Tuning

                        This issue has a mass of 182.

                        We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                        The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                        If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                        See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                        Refactorings

                        Further Reading

                        Method cisco_ios_config_eater has 324 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                            def cisco_ios_config_eater(thost, tport, config)

      if framework.db.active
        credential_data = {
          address: thost,
                        Severity: Major
                        Found in lib/msf/core/auxiliary/cisco.rb - About 1 day to fix

                          Method on_request_uri has 323 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def on_request_uri(cli, request)
    user_agent = request['User-Agent']
    print_status("Request from #{user_agent}")
    offsets = get_offsets(user_agent)
    unless offsets
                          Severity: Major
                          Found in modules/exploits/osx/browser/safari_proxy_object_type_confusion.rb - About 1 day to fix
                            Severity
                            Category
                            Status
                            Source
                            Language