rapid7/metasploit-framework

View on GitHub

Showing 21,886 of 21,886 total issues

File manageengine_adaudit_plus_cve_2022_28219.rb has 322 lines of code (exceeds 250 allowed). Consider refactoring.
Open

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck

    File enum_chrome.rb has 322 lines of code (exceeds 250 allowed). Consider refactoring.
    Open

    class MetasploitModule < Msf::Post
      include Msf::Post::File
      include Msf::Post::Windows::Priv
    
      def initialize(info = {})
    Severity: Minor
    Found in modules/post/windows/gather/enum_chrome.rb - About 3 hrs to fix

      File clipboard.rb has 322 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      require 'rex/post/meterpreter'
      require 'rex/post/meterpreter/extensions/extapi/command_ids'
      
      module Rex
      module Post

        Method initialize has 93 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def initialize(info = {})
            super(update_info(info,
              'Name'           => 'Novell eDirectory eMBox Unauthenticated File Access',
              'Description'    => %q{
                  This module will access Novell eDirectory's eMBox service and can run the
        Severity: Major
        Found in modules/auxiliary/admin/edirectory/edirectory_edirutil.rb - About 3 hrs to fix

          Method run_host has 93 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def run_host(ip)
              begin
                snmp = connect_snmp
          
                vprint_status("Connecting to #{ip}")
          Severity: Major
          Found in modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb - About 3 hrs to fix

            Method initialize_tables has 93 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def initialize_tables
            
                @computer_table = Msf::Ui::Console::Table.new(
                  Msf::Ui::Console::Table::Style::Default,
                  'Header' => "Remote Computer Listing",
            Severity: Major
            Found in modules/auxiliary/scanner/sap/sap_hostctrl_getcomputersystem.rb - About 3 hrs to fix

              Method do_login has 93 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def do_login(user, pass)
                  vprint_status("#{rhost}:#{rport} - Trying username:#{user.inspect} with password:#{pass.inspect}")
              
                  # Set Cookie - Box is vuln to Session Fixation. Generating a random cookie for use.
                  randomvalue = Rex::Text.rand_text_alphanumeric(26)
              Severity: Major
              Found in modules/auxiliary/scanner/http/gavazzi_em_login_loot.rb - About 3 hrs to fix

                Method syscall_parser has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def syscall_parser
                    %@
                    SYSCALL_LIST _SyscallList;
                
                    DWORD HashSyscall(PCSTR FunctionName)
                Severity: Major
                Found in modules/evasion/windows/syscall_inject.rb - About 3 hrs to fix

                  Method initialize has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def initialize(info = {})
                      super(update_info(
                        info,
                        'Name'           => 'Splunk Custom App Remote Code Execution',
                        'Description'    =>
                  Severity: Major
                  Found in modules/exploits/multi/http/splunk_upload_app_exec.rb - About 3 hrs to fix

                    Method initialize has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def initialize(info = {})
                        super(
                          update_info(
                            info,
                            'Name' => 'SugarCRM unauthenticated Remote Code Execution (RCE)',
                    Severity: Major
                    Found in modules/exploits/multi/http/sugarcrm_webshell_cve_2023_22952.rb - About 3 hrs to fix

                      Method exploit has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def exploit
                          unless check == Exploit::CheckCode::Appears
                            fail_with(Failure::NotVulnerable, 'Target is not vulnerable')
                          end
                      
                      
                      Severity: Major
                      Found in modules/exploits/multi/http/phpmyadmin_lfi_rce.rb - About 3 hrs to fix

                        Method initialize has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def initialize(info = {})
                            super(
                              update_info(
                                info,
                                'Name' => 'Apache Commons Text RCE',
                        Severity: Major
                        Found in modules/exploits/multi/http/apache_commons_text4shell.rb - About 3 hrs to fix

                          Method find_target_cgi has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def find_target_cgi
                          
                              target_uris = []
                              common_dirs = %W^
                          /
                          Severity: Major
                          Found in modules/exploits/linux/http/goahead_ldpreload.rb - About 3 hrs to fix

                            Method run has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def run
                                userhives = load_missing_hives
                                userhives.each do |hive|
                                  next if hive['HKU'].nil?
                            
                            
                            Severity: Major
                            Found in modules/post/windows/gather/credentials/heidisql.rb - About 3 hrs to fix

                              Method cmd_migrate has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def cmd_migrate(*args)
                                  if args.length == 0 || args.any? { |arg| %w(-h --pid --name).include? arg }
                                    cmd_migrate_help
                                    return true
                                  end
                              Severity: Major
                              Found in lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb - About 3 hrs to fix

                                Method creds_add has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def creds_add(*args)
                                    params = args.inject({}) do |hsh, n|
                                      opt = n.split(':') # Splitting the string on colons.
                                      hsh[opt[0]] = opt[1..-1].join(':') # everything before the first : is the key, reasembling everything after the colon. why ntlm hashes
                                      hsh
                                Severity: Major
                                Found in lib/msf/ui/console/command_dispatcher/creds.rb - About 3 hrs to fix

                                  Method each_unfiltered_password_first has 93 lines of code (exceeds 25 allowed). Consider refactoring.
                                  Open

                                      def each_unfiltered_password_first
                                        if user_file.present?
                                          user_fd = File.open(user_file, 'r:binary')
                                        end
                                  
                                  
                                  Severity: Major
                                  Found in lib/metasploit/framework/credential_collection.rb - About 3 hrs to fix

                                    Similar blocks of code found in 2 locations. Consider refactoring.
                                    Open

                                      def read_discrete_inputs
                                        if datastore['NUMBER'] + datastore['DATA_ADDRESS'] > 65535
                                          print_error('DISCRETE INPUT addresses go from 0 to 65535. You cannot go beyond.')
                                          return
                                        end
                                    Severity: Major
                                    Found in modules/auxiliary/scanner/scada/modbusclient.rb and 1 other location - About 3 hrs to fix
                                    modules/auxiliary/scanner/scada/modbusclient.rb on lines 160..189

                                    Duplicated Code

                                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                                    Tuning

                                    This issue has a mass of 129.

                                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                                    Refactorings

                                    Further Reading

                                    Similar blocks of code found in 2 locations. Consider refactoring.
                                    Open

                                      def check
                                        # sanity check to see if the target is likely OpenTSDB
                                        res1 = send_request_cgi({
                                          'method' => 'GET',
                                          'uri' => normalize_uri(target_uri.path)
                                    Severity: Major
                                    Found in modules/exploits/linux/http/opentsdb_key_cmd_injection.rb and 1 other location - About 3 hrs to fix
                                    modules/exploits/linux/http/opentsdb_yrange_cmd_injection.rb on lines 87..136

                                    Duplicated Code

                                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                                    Tuning

                                    This issue has a mass of 129.

                                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                                    Refactorings

                                    Further Reading

                                    Similar blocks of code found in 2 locations. Consider refactoring.
                                    Open

                                      def read_coils
                                        if datastore['NUMBER'] + datastore['DATA_ADDRESS'] > 65535
                                          print_error('Coils addresses go from 0 to 65535. You cannot go beyond.')
                                          return
                                        end
                                    Severity: Major
                                    Found in modules/auxiliary/scanner/scada/modbusclient.rb and 1 other location - About 3 hrs to fix
                                    modules/auxiliary/scanner/scada/modbusclient.rb on lines 192..221

                                    Duplicated Code

                                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                                    Tuning

                                    This issue has a mass of 129.

                                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                                    Refactorings

                                    Further Reading

                                    Severity
                                    Category
                                    Status
                                    Source
                                    Language