rapid7/metasploit-framework

View on GitHub

Showing 21,757 of 21,757 total issues

Method handle_connection has a Cognitive Complexity of 27 (exceeds 5 allowed). Consider refactoring.
Open

  def handle_connection(conn, opts={})

    # If the stage should be sent over the client connection that is
    # established (which is the default), then go ahead and transmit it.
    if (stage_over_connection?)
Severity: Minor
Found in lib/msf/core/payload/stager.rb - About 3 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method attempt_login has a Cognitive Complexity of 27 (exceeds 5 allowed). Consider refactoring.
Open

        def attempt_login(credential)
          result_options = {
              credential: credential,
              host: host,
              port: port,
Severity: Minor
Found in lib/metasploit/framework/login_scanner/telnet.rb - About 3 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

                    elif str(attribute['type']) == 'lastLogon':
                        if str(attribute['vals'][0]) == '0':
                            lastLogon = '<never>'
                        else:
                            lastLogon = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
Severity: Major
Found in modules/auxiliary/gather/get_user_spns.py and 1 other location - About 3 hrs to fix
modules/auxiliary/gather/get_user_spns.py on lines 352..356

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 73.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

                    elif str(attribute['type']) == 'pwdLastSet':
                        if str(attribute['vals'][0]) == '0':
                            pwdLastSet = '<never>'
                        else:
                            pwdLastSet = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
Severity: Major
Found in modules/auxiliary/gather/get_user_spns.py and 1 other location - About 3 hrs to fix
modules/auxiliary/gather/get_user_spns.py on lines 357..361

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 73.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Identical blocks of code found in 2 locations. Consider refactoring.
Open

  def on_request_uri( cli, request )
    data = ""
    host = ""
    port = ""

Severity: Major
Found in modules/exploits/multi/browser/java_atomicreferencearray.rb and 1 other location - About 3 hrs to fix
modules/exploits/multi/browser/java_verifier_field_access.rb on lines 96..150

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 135.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Identical blocks of code found in 2 locations. Consider refactoring.
Open

  def on_request_uri( cli, request )
    data = ""
    host = ""
    port = ""

Severity: Major
Found in modules/exploits/multi/browser/java_verifier_field_access.rb and 1 other location - About 3 hrs to fix
modules/exploits/multi/browser/java_atomicreferencearray.rb on lines 96..150

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 135.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

File vcenter.rb has 329 lines of code (exceeds 250 allowed). Consider refactoring.
Open

module Msf
  class Post
    module Vcenter
      module Vcenter
        include Msf::Post::File
Severity: Minor
Found in lib/msf/core/post/vcenter/vcenter.rb - About 3 hrs to fix

    Identical blocks of code found in 3 locations. Consider refactoring.
    Open

      def on_request_uri(cli, request)
    
        # For this exploit, this does little besides ensures the user agent is a recognized one..
        mytarget = target
        if target.name == 'Automatic'
    Severity: Major
    Found in modules/exploits/windows/browser/java_ws_vmargs.rb and 2 other locations - About 3 hrs to fix
    modules/exploits/windows/browser/java_ws_arginject_altjvm.rb on lines 94..148
    modules/exploits/windows/browser/java_ws_double_quote.rb on lines 95..145

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Identical blocks of code found in 3 locations. Consider refactoring.
    Open

      def on_request_uri(cli, request)
    
        # For this exploit, this does little besides ensures the user agent is a recognized one..
        mytarget = target
        if target.name == 'Automatic'
    modules/exploits/windows/browser/java_ws_double_quote.rb on lines 95..145
    modules/exploits/windows/browser/java_ws_vmargs.rb on lines 91..145

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Identical blocks of code found in 3 locations. Consider refactoring.
    Open

      def on_request_uri(cli, request)
    
        # For this exploit, this does little besides ensures the user agent is a recognized one..
        mytarget = target
        if target.name == 'Automatic'
    Severity: Major
    Found in modules/exploits/windows/browser/java_ws_double_quote.rb and 2 other locations - About 3 hrs to fix
    modules/exploits/windows/browser/java_ws_arginject_altjvm.rb on lines 94..148
    modules/exploits/windows/browser/java_ws_vmargs.rb on lines 91..145

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 5 locations. Consider refactoring.
    Open

        content = %Q|
          <html>
            <object id='#{vname}' classid='clsid:0A5FD7C5-A45C-49FC-ADB5-9952547D5715'></object>
            <script language="JavaScript">
            var #{rand1} = unescape('#{shellcode}');
    modules/exploits/windows/browser/adobe_utilprintf.rb on lines 77..91
    modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb on lines 86..107
    modules/exploits/windows/browser/msvidctl_mpeg2.rb on lines 204..220
    modules/exploits/windows/fileformat/emc_appextender_keyworks.rb on lines 73..91

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 5 locations. Consider refactoring.
    Open

        script = %Q|
        var #{rand1} = unescape("#{shellcode}");
        var #{randnop} = "#{nops}";
        var #{rand2} ="";
        for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape(#{randnop});
    Severity: Major
    Found in modules/exploits/windows/browser/adobe_utilprintf.rb and 4 other locations - About 3 hrs to fix
    modules/exploits/windows/browser/creative_software_cachefolder.rb on lines 74..91
    modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb on lines 86..107
    modules/exploits/windows/browser/msvidctl_mpeg2.rb on lines 204..220
    modules/exploits/windows/fileformat/emc_appextender_keyworks.rb on lines 73..91

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 5 locations. Consider refactoring.
    Open

    #{j_nops}=unescape('#{nops}');
    #{j_headersize}=20;
    #{j_slackspace}=#{j_headersize}+#{j_shellcode}.length;
    while(#{j_nops}.length<#{j_slackspace})#{j_nops}+=#{j_nops};
    #{j_fillblock}=#{j_nops}.substring(0,#{j_slackspace});
    Severity: Major
    Found in modules/exploits/windows/browser/msvidctl_mpeg2.rb and 4 other locations - About 3 hrs to fix
    modules/exploits/windows/browser/adobe_utilprintf.rb on lines 77..91
    modules/exploits/windows/browser/creative_software_cachefolder.rb on lines 74..91
    modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb on lines 86..107
    modules/exploits/windows/fileformat/emc_appextender_keyworks.rb on lines 73..91

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 5 locations. Consider refactoring.
    Open

        html = %Q|
          <html>
          <head>
            <script>
              try {
    modules/exploits/windows/browser/adobe_utilprintf.rb on lines 77..91
    modules/exploits/windows/browser/creative_software_cachefolder.rb on lines 74..91
    modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb on lines 86..107
    modules/exploits/windows/browser/msvidctl_mpeg2.rb on lines 204..220

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 5 locations. Consider refactoring.
    Open

        content = %Q|
    <html>
      <script language="javascript">
      var #{rand1}='<object classid="clsid:C932BA85-4374-101B-A56C-00AA003668DC"><param name="Mask" value="';
      var #{rand2}='"></object>';
    modules/exploits/windows/browser/adobe_utilprintf.rb on lines 77..91
    modules/exploits/windows/browser/creative_software_cachefolder.rb on lines 74..91
    modules/exploits/windows/browser/msvidctl_mpeg2.rb on lines 204..220
    modules/exploits/windows/fileformat/emc_appextender_keyworks.rb on lines 73..91

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 2 locations. Consider refactoring.
    Open

      def initialize(info = {})
        super(merge_info(info,
          'Name'          => 'Linux Command Shell, Reverse TCP Inline',
          'Description'   => 'Connect back to attacker and spawn a command shell',
          'Author'        => 'Ramon de C Valle',
    Severity: Major
    Found in modules/payloads/singles/linux/ppc/shell_reverse_tcp.rb and 1 other location - About 3 hrs to fix
    modules/payloads/singles/linux/ppc64/shell_reverse_tcp.rb on lines 15..79

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Similar blocks of code found in 2 locations. Consider refactoring.
    Open

      def initialize(info = {})
        super(merge_info(info,
          'Name'          => 'Linux Command Shell, Reverse TCP Inline',
          'Description'   => 'Connect back to attacker and spawn a command shell',
          'Author'        => 'Ramon de C Valle',
    Severity: Major
    Found in modules/payloads/singles/linux/ppc64/shell_reverse_tcp.rb and 1 other location - About 3 hrs to fix
    modules/payloads/singles/linux/ppc/shell_reverse_tcp.rb on lines 15..79

    Duplicated Code

    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

    Tuning

    This issue has a mass of 134.

    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

    Refactorings

    Further Reading

    Method initialize has 97 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def initialize(info = {})
        super(
          update_info(
            info,
            'Name'           => 'Steamed Hams',
    Severity: Major
    Found in modules/exploits/multi/hams/steamed.rb - About 3 hrs to fix

      Method initialize has 97 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def initialize(info = {})
          super(
            update_info(
              info,
              'Name' => 'ManageEngine ServiceDesk Plus Unauthenticated SAML RCE',

        Method initialize has 97 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def initialize(info = {})
            super(
              update_info(
                info,
                'Name' => 'Kubernetes authenticated code execution',
        Severity: Major
        Found in modules/exploits/multi/kubernetes/exec.rb - About 3 hrs to fix
          Severity
          Category
          Status
          Source
          Language