rapid7/metasploit-framework

View on GitHub

Showing 7,361 of 22,177 total issues

Method normalize_entry has 77 lines of code (exceeds 25 allowed). Consider refactoring.
Open

      def normalize_entry(entry, attribute_properties)
        # Convert to a hash so we get the raw data we need from within the Net::LDAP::Entry object
        entry = entry.to_h
        normalized_entry = { dn: entry[:dn] }
        entry.each_key do |attribute_name|
Severity: Major
Found in lib/msf/core/exploit/remote/ldap/queries.rb - About 3 hrs to fix

    Method authenticate_via_krb5_ccache_credential_tgt has 77 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def authenticate_via_krb5_ccache_credential_tgt(credential, options = {})
        realm = self.realm.upcase
        sname = options.fetch(:sname)
        client_name = username
    
    
    Severity: Major
    Found in lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb - About 3 hrs to fix

      Method read_delta has 77 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

          def self.read_delta(type, content, base_obj_sha)
            source_len = 0
            target_len = 0
      
            delta = { type: type, base: base_obj_sha }
      Severity: Major
      Found in lib/msf/core/exploit/git/packfile.rb - About 3 hrs to fix

        Method asm_block_recv has 77 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def asm_block_recv(opts={})
            reliable     = opts[:reliable]
            asm = %Q^
              recv:
                ; Receive the size of the incoming second stage...
        Severity: Major
        Found in lib/msf/core/payload/windows/reverse_tcp.rb - About 3 hrs to fix

          Similar blocks of code found in 2 locations. Consider refactoring.
          Open

            def run_host(ip)
          
              if not is_imc?
                vprint_error("#{rhost}:#{rport} - This isn't a HP Intelligent Management Center")
                return
          modules/auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal.rb on lines 62..97

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 109.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 2 locations. Consider refactoring.
          Open

            def run_host(ip)
          
              if not is_imc?
                vprint_error("#{rhost}:#{rport} - This isn't a HP Intelligent Management Center")
                return
          modules/auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal.rb on lines 62..97

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 109.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Method cmd_wmap_nodes has 76 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

                def cmd_wmap_nodes(*args)
                  if !rpcarr
                    self.rpcarr = Hash.new
                  end
          
          
          Severity: Major
          Found in plugins/wmap.rb - About 3 hrs to fix

            Method run has 76 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def run
                # starts up the Listener Server
                print_status("Starting listener...")
                listener = Rex::Socket::TcpServer.create(
                  'LocalHost' => '0.0.0.0',
            Severity: Major
            Found in modules/auxiliary/admin/vnc/realvnc_41_bypass.rb - About 3 hrs to fix

              Method scanner_postscan has 76 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def scanner_postscan(batch)
              
                  cnt = 0
              
                  # Perform a second pass based on responsive hosts
              Severity: Major
              Found in modules/auxiliary/scanner/netbios/nbname.rb - About 3 hrs to fix

                Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def initialize(info = {})
                    super(
                      update_info(
                        info,
                        'Name' => 'Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE',
                Severity: Major
                Found in modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb - About 3 hrs to fix

                  Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def initialize(info = {})
                      super(
                        update_info(
                          info,
                          'Name' => 'Xorg X11 Server SUID modulepath Privilege Escalation',
                  Severity: Major
                  Found in modules/exploits/multi/local/xorg_x11_suid_server_modulepath.rb - About 3 hrs to fix

                    Method upload_webshell has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def upload_webshell
                        # randomize file name if option WEBSHELL is not set
                        @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : "#{datastore['WEBSHELL']}.php")
                    
                        # randomize e-mail address, firstname and lastname to be used in payload and POST requests
                    Severity: Major
                    Found in modules/exploits/multi/http/gambio_unauth_rce_cve_2024_23759.rb - About 3 hrs to fix

                      Method exploit has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def exploit
                          jsp_name = datastore['JSP'] || rand_text_alpha(8+rand(8))
                          app_base = datastore['APPBASE'] || rand_text_alpha(8+rand(8))
                          stager_base = rand_text_alpha(8+rand(8))
                          stager_jsp_name  = rand_text_alpha(8+rand(8))
                      Severity: Major
                      Found in modules/exploits/multi/http/jboss_deploymentfilerepository.rb - About 3 hrs to fix

                        Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def initialize(info={})
                            super(update_info(info,
                              'Name'                => 'Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free',
                              'Description'         => %q{
                                This module exploits a use after free vulnerability in Adobe Flash Player. The
                        Severity: Major
                        Found in modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb - About 3 hrs to fix

                          Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def initialize(info = {})
                              super(update_info(info,
                                'Name'            => 'EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution',
                                'Description'     => %q{
                                  This module exploits multiple vulnerabilities in EyesOfNetwork version 5.1, 5.2
                          Severity: Major
                          Found in modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb - About 3 hrs to fix

                            Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def initialize(info = {})
                                super(
                                  update_info(
                                    info,
                                    'Name' => 'LinuxKI Toolset 6.01 Remote Command Execution',
                            Severity: Major
                            Found in modules/exploits/linux/http/linuxki_rce.rb - About 3 hrs to fix

                              Method initialize has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def initialize(info = {})
                                  super(update_info(info,
                                    'Name'        => 'NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution',
                                    'Description' => %q{
                                      The NVRmini 2 Network Video Recorder, Crystal NVR and the ReadyNAS Surveillance application are vulnerable
                              Severity: Major
                              Found in modules/exploits/linux/http/nuuo_nvrmini_auth_rce.rb - About 3 hrs to fix

                                Method information_leak has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def information_leak
                                    print_status("Trying information leak...")
                                    leaked_arch = nil
                                    leaked_addr = []
                                
                                
                                Severity: Major
                                Found in modules/exploits/linux/smtp/exim_gethostbyname_bof.rb - About 3 hrs to fix

                                  Method check_lines has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                                  Open

                                    def check_lines
                                      url_ok     = true
                                      no_stdio   = true
                                      in_comment = false
                                      in_literal = false
                                  Severity: Major
                                  Found in tools/dev/msftidy.rb - About 3 hrs to fix

                                    Method dispatch_request has 76 lines of code (exceeds 25 allowed). Consider refactoring.
                                    Open

                                      def dispatch_request(from, buf)
                                    
                                        op = buf.unpack('n')[0]
                                        buf.slice!(0,2)
                                    
                                    
                                    Severity: Major
                                    Found in lib/rex/proto/tftp/server.rb - About 3 hrs to fix
                                      Severity
                                      Category
                                      Status
                                      Source
                                      Language