rapid7/metasploit-framework

View on GitHub

Showing 7,361 of 22,177 total issues

Method on_request_uri has 87 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def on_request_uri(cli, request)

    mytarget = target
    if target.name == 'Automatic'
      mytarget = auto_target(cli, request)
Severity: Major
Found in modules/exploits/windows/browser/wmi_admintools.rb - About 3 hrs to fix

    Method exploit has 87 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def exploit
    
        print_status("Creating PowerPoint Document ...")
    
        username = Rex::Text.rand_text_alphanumeric(8+rand(8))
    Severity: Major
    Found in modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb - About 3 hrs to fix

      Method exploit has 87 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def exploit
      
          @pl = generate_payload_exe
          @elf_sent = false
      
      
      Severity: Major
      Found in modules/exploits/linux/smtp/exim4_dovecot_exec.rb - About 3 hrs to fix

        Method cmd_route has 87 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def cmd_route(*args)
            # Default to list
            if (args.length == 0)
              args.unshift('list')
            end
        Severity: Major
        Found in lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb - About 3 hrs to fix

          Method build_response has 87 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def build_response(packet, function, layouts, client)
              case client.native_arch
              when ARCH_X64
                native = 'Q<'
              when ARCH_X86
          Severity: Major
          Found in lib/rex/post/meterpreter/extensions/stdapi/railgun/library.rb - About 3 hrs to fix

            Method monitor_socket has 87 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def monitor_socket
            
                # Skip if we are using a passive dispatcher
                return if self.passive_service
            
            
            Severity: Major
            Found in lib/rex/post/meterpreter/packet_dispatcher.rb - About 3 hrs to fix

              Method cmd_use has 87 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                        def cmd_use(*args)
                          if args.length == 0 || args.first == '-h'
                            cmd_use_help
                            return false
                          end
              Severity: Major
              Found in lib/msf/ui/console/command_dispatcher/modules.rb - About 3 hrs to fix

                Method on_request has 87 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def on_request(cli, req)
                    Thread.current[:cli] = cli
                    resp = Rex::Proto::Http::Response.new
                    info = process_uri_resource(req.relative_resource)
                    uuid = info[:uuid]
                Severity: Major
                Found in lib/msf/core/handler/reverse_http.rb - About 3 hrs to fix

                  Method report_secrets has 87 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def report_secrets(namespace, secrets)
                      origin = create_credential_origin_service(
                        {
                          address: datastore['RHOST'],
                          port: datastore['RPORT'],
                  Severity: Major
                  Found in lib/msf/core/exploit/remote/http/kubernetes/enumeration.rb - About 3 hrs to fix

                    Identical blocks of code found in 2 locations. Consider refactoring.
                    Open

                      def run
                        last_str = nil
                        last_inp = nil
                        last_err = nil
                    
                    
                    Severity: Major
                    Found in modules/auxiliary/fuzzers/ssh/ssh_version_2.rb and 1 other location - About 3 hrs to fix
                    modules/auxiliary/fuzzers/ssh/ssh_version_15.rb on lines 34..77

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 121.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Identical blocks of code found in 2 locations. Consider refactoring.
                    Open

                      def run
                        last_str = nil
                        last_inp = nil
                        last_err = nil
                    
                    
                    Severity: Major
                    Found in modules/auxiliary/fuzzers/ssh/ssh_version_15.rb and 1 other location - About 3 hrs to fix
                    modules/auxiliary/fuzzers/ssh/ssh_version_2.rb on lines 34..77

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 121.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Similar blocks of code found in 2 locations. Consider refactoring.
                    Open

                      def on_request_uri( cli, request )
                    
                        if not request.uri.match(/\.jar$/i)
                          if not request.uri.match(/\/$/)
                            send_redirect(cli, get_resource() + '/', '')
                    Severity: Major
                    Found in modules/exploits/multi/browser/java_jre17_exec.rb and 1 other location - About 3 hrs to fix
                    modules/exploits/multi/browser/java_rhino.rb on lines 73..109

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 121.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Similar blocks of code found in 2 locations. Consider refactoring.
                    Open

                      def on_request_uri( cli, request )
                        if not request.uri.match(/\.jar$/i)
                          if not request.uri.match(/\/$/)
                            send_redirect(cli, get_resource() + '/', '')
                            return
                    Severity: Major
                    Found in modules/exploits/multi/browser/java_rhino.rb and 1 other location - About 3 hrs to fix
                    modules/exploits/multi/browser/java_jre17_exec.rb on lines 82..119

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 121.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Method parse has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def parse
                    vers = [
                      '6.1.4',
                      '6.1.3',
                      '6.1.2',
                    Severity: Major
                    Found in external/source/unixasm/aix-power.rb - About 3 hrs to fix

                      Method gettfiles has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def gettfiles(rhost,logfile,filelen)
                          if filelen
                            print_status("#{rhost}:#{rport} [SAP] Attempting to retrieve file #{logfile} (#{filelen} bytes)")
                          else
                            print_status("#{rhost}:#{rport} [SAP] Attempting to retrieve file #{logfile} (size unknown)")
                      Severity: Major
                      Found in modules/auxiliary/scanner/sap/sap_mgmt_con_getlogfiles.rb - About 3 hrs to fix

                        Method generate has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def generate(_opts = {})
                            # Split the cmd string into arg chunks
                            cmd_str = datastore['CMD']
                            cmd_and_args = Shellwords.shellsplit(cmd_str).map { |s| "#{s}\x00" }
                        
                        
                        Severity: Major
                        Found in modules/payloads/singles/osx/aarch64/shell_reverse_tcp.rb - About 3 hrs to fix

                          Method generate has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def generate(opts={})
                              cmd             = datastore['CMD'] || ''
                              nullfreeversion = datastore['NullFreeVersion']
                              if cmd.empty?
                                #
                          Severity: Major
                          Found in modules/payloads/singles/linux/x86/exec.rb - About 3 hrs to fix

                            Method initialize has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def initialize(info = {})
                                super(update_info(
                                  info,
                                  'Name' => 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390',
                                  'Description' => %q(
                            Severity: Major
                            Found in modules/exploits/multi/http/git_client_command_exec.rb - About 3 hrs to fix

                              Method gen_resp has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def gen_resp
                                  if target.name == 'Windows'
                                    pwrshl = cmd_psh_payload(payload.encoded, payload_instance.arch.first, {remove_comspec: true})
                                    mycmd = pwrshl.each_byte.map {|b| b.to_s(16)}.join
                                  elsif target.name == 'Unix' || target.name == 'Solaris'
                              Severity: Major
                              Found in modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb - About 3 hrs to fix

                                Method execute_command has 86 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def execute_command(cmd, opts = {})
                                    uri = target_uri.path
                                
                                    print_status('Creating session.')
                                    res = send_request_cgi({
                                Severity: Major
                                Found in modules/exploits/multi/misc/consul_rexec_exec.rb - About 3 hrs to fix
                                  Severity
                                  Category
                                  Status
                                  Source
                                  Language