Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 22,177 of 22,177 total issues

Method make_js has 125 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def make_js(encoded_payload)

    # The following executes a ret2lib using BIB.dll
    # The effect is to bypass DEP and execute the shellcode in an indirect way
    stack_data = [
Severity: Major
Found in modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb - About 5 hrs to fix

    Class IO has 38 methods (exceeds 20 allowed). Consider refactoring.
    Open

    class IO
  protected
    attr_accessor :filed, :mode
  public
    Severity: Minor
    Found in lib/rex/post/io.rb - About 5 hrs to fix

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

              for i in sorted(docs):
            if i in modules:
                print_or_write('+ [x] %s' %(make_link(i.split('metasploit-framework')[1])))
            else:
                print_or_write('+ [ ] %s' %(make_link(i.split('metasploit-framework')[1])))
      Severity: Major
      Found in tools/docs/issue_finder.py and 1 other location - About 5 hrs to fix
      tools/docs/issue_finder.py on lines 93..98

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 86.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

              for i in sorted(modules):
            if i in docs:
                print_or_write('+ [x] %s' %(make_link(i.split('metasploit-framework')[1])))
            else:
                print_or_write('+ [ ] %s' %(make_link(i.split('metasploit-framework')[1])))
      Severity: Major
      Found in tools/docs/issue_finder.py and 1 other location - About 5 hrs to fix
      tools/docs/issue_finder.py on lines 102..107

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 86.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

      <object classid='clsid:22ACD16F-99EB-11D2-9BB3-00400561D975' id='#{pvcalendar}'></object>
<script language='javascript'>
#{j_shellcode} = unescape('#{shellcode}');
#{randnop} = "#{nops}";
#{j_nops} = unescape(#{randnop});
      Severity: Major
      Found in modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb and 1 other location - About 5 hrs to fix
      modules/exploits/windows/browser/autodesk_idrop.rb on lines 89..122

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 167.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

      module MetasploitModule
  include Msf::Sessions::MeterpreterOptions
  include Msf::Sessions::MettleConfig

  def initialize(info = {})
      Severity: Major
      Found in modules/payloads/stages/linux/mipsle/meterpreter.rb and 1 other location - About 5 hrs to fix
      modules/payloads/stages/linux/mipsbe/meterpreter.rb on lines 8..95

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 167.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

      <html>
<head>
<script language='javascript' defer>
function #{j_function}() {
  #{j_shellcode}=unescape('#{shellcode}');
      Severity: Major
      Found in modules/exploits/windows/browser/autodesk_idrop.rb and 1 other location - About 5 hrs to fix
      modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb on lines 88..108

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 167.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 2 locations. Consider refactoring.
      Open

      module MetasploitModule
  include Msf::Sessions::MeterpreterOptions
  include Msf::Sessions::MettleConfig

  def initialize(info = {})
      Severity: Major
      Found in modules/payloads/stages/linux/mipsbe/meterpreter.rb and 1 other location - About 5 hrs to fix
      modules/payloads/stages/linux/mipsle/meterpreter.rb on lines 8..95

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 167.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      File owa_login.rb has 374 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
      Severity: Minor
      Found in modules/auxiliary/scanner/http/owa_login.rb - About 5 hrs to fix

        File chrome_filereader_uaf.rb has 374 lines of code (exceeds 250 allowed). Consider refactoring.
        Open

        class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::HttpServer
        Severity: Minor
        Found in modules/exploits/windows/browser/chrome_filereader_uaf.rb - About 5 hrs to fix

          File resolver.rb has 374 lines of code (exceeds 250 allowed). Consider refactoring.
          Open

          require 'net/dns/resolver'
require 'dnsruby'

module Rex
module Proto
          Severity: Minor
          Found in lib/rex/proto/dns/resolver.rb - About 5 hrs to fix

            Method run_host has 124 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def run_host(ip)
    print_brute(level: :vstatus, ip: ip, msg: 'Starting SMB login bruteforce')

    domain = datastore['SMBDomain'] || ''
            Severity: Major
            Found in modules/auxiliary/scanner/smb/smb_login.rb - About 4 hrs to fix

              Method initialize has 124 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def initialize(info = {})
    super(
      merge_info(
        info,
        'Name' => 'Windows x86 Pingback, Reverse TCP Inline',
              Severity: Major
              Found in modules/payloads/singles/windows/pingback_reverse_tcp.rb - About 4 hrs to fix

                Method generate_rop_chain has 124 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def generate_rop_chain
    # RAX -> HMODULE GetModuleHandleA(
    #   ( RCX == *module ) LPCSTR lpModuleName,
    # );
    rop_gadgets = [0x0000000140018c42] * 15 # ret
                Severity: Major
                Found in modules/exploits/windows/nimsoft/nimcontroller_bof.rb - About 4 hrs to fix

                  Method is_match has 124 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def is_match(params, module_metadata)
    return true if params.empty?

    param_hash = params
                  Severity: Major
                  Found in lib/msf/core/modules/metadata/search.rb - About 4 hrs to fix

                    File manager.rb has 373 lines of code (exceeds 250 allowed). Consider refactoring.
                    Open

                    require 'snmp/pdu'
require 'snmp/mib'
require 'socket'
require 'timeout'
require 'thread'
                    Severity: Minor
                    Found in lib/snmp/manager.rb - About 4 hrs to fix

                      Method exploit has 123 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def exploit
    if datastore["NetlinkPID"] and datastore["NetlinkPID"] != 0
      netlink_pid = datastore["NetlinkPID"]
    else
      print_status("Attempting to autodetect netlink pid...")
                      Severity: Major
                      Found in modules/exploits/linux/local/udev_netlink.rb - About 4 hrs to fix

                        Method scheduleme has a Cognitive Complexity of 33 (exceeds 5 allowed). Consider refactoring.
                        Open

                        def scheduleme(session,schtype,cmd,tmmod,cmdopt,username,password)
  execmd = ""
  success = false
  taskname = "syscheck#{rand(100)}"
  if cmdopt != nil
                        Severity: Minor
                        Found in scripts/meterpreter/scheduleme.rb - About 4 hrs to fix

                        Cognitive Complexity

                        Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                        A method's cognitive complexity is based on a few simple rules:

                        • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                        • Code is considered more complex for each "break in the linear flow of the code"
                        • Code is considered more complex when "flow breaking structures are nested"

                        Further reading

                        Method run_host has a Cognitive Complexity of 33 (exceeds 5 allowed). Consider refactoring.
                        Open

                          def run_host(ip)

    timeout = datastore['TIMEOUT'].to_i

    instances = datastore['INSTANCES']
                        Severity: Minor
                        Found in modules/auxiliary/scanner/sap/sap_service_discovery.rb - About 4 hrs to fix

                        Cognitive Complexity

                        Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                        A method's cognitive complexity is based on a few simple rules:

                        • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                        • Code is considered more complex for each "break in the linear flow of the code"
                        • Code is considered more complex when "flow breaking structures are nested"

                        Further reading

                        Method do_login has a Cognitive Complexity of 33 (exceeds 5 allowed). Consider refactoring.
                        Open

                          def do_login(user, pass)
    vprint_status("#{rhost}:#{rport} - Trying username:#{user.inspect} with password:#{pass.inspect}")

    # Set Cookie - Box is vuln to Session Fixation. Generating a random cookie for use.
    randomvalue = Rex::Text.rand_text_alphanumeric(26)
                        Severity: Minor
                        Found in modules/auxiliary/scanner/http/gavazzi_em_login_loot.rb - About 4 hrs to fix

                        Cognitive Complexity

                        Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                        A method's cognitive complexity is based on a few simple rules:

                        • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                        • Code is considered more complex for each "break in the linear flow of the code"
                        • Code is considered more complex when "flow breaking structures are nested"

                        Further reading

                        Severity
                        Category
                        Status
                        Source
                        Language