File opennms_horizon_authenticated_rce.rb has 651 lines of code (exceeds 250 allowed). Consider refactoring.

Open

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

Method escalate_or_deescalate_privs has a Cognitive Complexity of 61 (exceeds 5 allowed). Consider refactoring.

Open

  def escalate_or_deescalate_privs(deescalate: false)
    # Establish some variables based on if we need to escalate or deescalate privileges
    if deescalate
      use_filesystem = @role_to_add != 'ROLE_FILESYSTEM_EDITOR'
      mode = 'cleanup'

• Read up
  Read up

Method check has a Cognitive Complexity of 27 (exceeds 5 allowed). Consider refactoring.

Open

  def check
    # Try to authenticate
    success, msg_or_check_code = opennms_login('check')
    return msg_or_check_code unless success

• Read up
  Read up

Class MetasploitModule has 28 methods (exceeds 20 allowed). Consider refactoring.

Open

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

Method opennms_login has a Cognitive Complexity of 23 (exceeds 5 allowed). Consider refactoring.

Open

  def opennms_login(mode, perform_invalid_login: false)
    if perform_invalid_login
      user = Rex::Text.rand_text_alpha(8..12)
      pass = Rex::Text.rand_text_alpha(8..12)
      keep_cookies = false

• Read up
  Read up

Method escalate_or_deescalate_privs has 79 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def escalate_or_deescalate_privs(deescalate: false)
    # Establish some variables based on if we need to escalate or deescalate privileges
    if deescalate
      use_filesystem = @role_to_add != 'ROLE_FILESYSTEM_EDITOR'
      mode = 'cleanup'

Method cleanup has a Cognitive Complexity of 20 (exceeds 5 allowed). Consider refactoring.

Open

  def cleanup
    return if [@payload_file_name, @notification_name, @destination_path_name, @notification_command_name, @role_to_add].all?(&:blank?)

    print_status('Attempting cleanup...')
    # to be on the safe side, we'll clear the cookie jar and log in again

• Read up
  Read up

Method check has 58 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def check
    # Try to authenticate
    success, msg_or_check_code = opennms_login('check')
    return msg_or_check_code unless success

Method initialize has 58 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'OpenNMS Horizon Authenticated RCE',

Method opennms_login has 57 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def opennms_login(mode, perform_invalid_login: false)
    if perform_invalid_login
      user = Rex::Text.rand_text_alpha(8..12)
      pass = Rex::Text.rand_text_alpha(8..12)
      keep_cookies = false

Method cleanup has 44 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def cleanup
    return if [@payload_file_name, @notification_name, @destination_path_name, @notification_command_name, @role_to_add].all?(&:blank?)

    print_status('Attempting cleanup...')
    # to be on the safe side, we'll clear the cookie jar and log in again

Method grab_and_parse_xml_config_file has a Cognitive Complexity of 14 (exceeds 5 allowed). Consider refactoring.

Open

  def grab_and_parse_xml_config_file(file_name, root_element, element, mode, filesystem: true)
    request_hash = {
      'method' => 'GET',
      'keep_cookies' => true
    }

• Read up
  Read up

Method revert_xml_config_file has a Cognitive Complexity of 13 (exceeds 5 allowed). Consider refactoring.

Open

  def revert_xml_config_file(file_name, root_element, element, element_to_remove)
    # First we need to get the current #{file_name} file, so we can remove our #{element_name} from it
    success, xml_doc_or_msg = grab_and_parse_xml_config_file(file_name, root_element, element, 'cleanup')
    unless success
      print_error(xml_doc_or_msg)

• Read up
  Read up

Method revert_xml_config_file has 36 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def revert_xml_config_file(file_name, root_element, element, element_to_remove)
    # First we need to get the current #{file_name} file, so we can remove our #{element_name} from it
    success, xml_doc_or_msg = grab_and_parse_xml_config_file(file_name, root_element, element, 'cleanup')
    unless success
      print_error(xml_doc_or_msg)

Method grab_and_parse_xml_config_file has 36 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def grab_and_parse_xml_config_file(file_name, root_element, element, mode, filesystem: true)
    request_hash = {
      'method' => 'GET',
      'keep_cookies' => true
    }

Method update_configuration has 32 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def update_configuration(mode)
    # We need to update the configuration in order for our changes to take effect
    xml_doc = Nokogiri::XML::Builder.new do |xml|
      xml.event('xmlns' => 'http://xmlns.opennms.org/xsd/event') do
        xml.uei('uei.opennms.org/internal/reloadDaemonConfig')

Method edit_xml_config_file has 29 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def edit_xml_config_file(file_name, root_element, element)
    # First we need to get the current #{file_name} file, so we can edit our #{element_name} in it
    _success, xml_doc = grab_and_parse_xml_config_file(file_name, root_element, element, 'exploit')

    # update the xml document with a new element

Method write_payload_to_bsh_file has 29 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def write_payload_to_bsh_file(cmd)
    # We need to write our payload to a .bsh file so that it can be executed by the notification command

    post_data = generate_post_data(@payload_file_name, cmd)

Method write_payload_to_bsh_file has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring.

Open

  def write_payload_to_bsh_file(cmd)
    # We need to write our payload to a .bsh file so that it can be executed by the notification command

    post_data = generate_post_data(@payload_file_name, cmd)

• Read up
  Read up

Method deal_with_failure_by_mode has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.

Open

  def deal_with_failure_by_mode(mode, message, status)
    return [false, "#{message}. Manual cleanup is required."] if mode == 'cleanup'

    case status
    when 'disconnected'

• Read up
  Read up

Method update_configuration has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.

Open

  def update_configuration(mode)
    # We need to update the configuration in order for our changes to take effect
    xml_doc = Nokogiri::XML::Builder.new do |xml|
      xml.event('xmlns' => 'http://xmlns.opennms.org/xsd/event') do
        xml.uei('uei.opennms.org/internal/reloadDaemonConfig')

• Read up
  Read up

Method ensure_notifications_enabled has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring.

Open

  def ensure_notifications_enabled
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.jsp'),
      'keep_cookies' => true

• Read up
  Read up

Avoid too many return statements within this method.

Open

      return CheckCode::Appears("User #{username} has #{@highest_priv} privileges. Exploitation is likely possible via privilege escalation to ROLE_FILESYSTEM_EDITOR.")

Avoid too many return statements within this method.

Open

      return CheckCode::Detected("Exploitation requires privilege escalation, which is not possible for OpenNMS version #{version}.")

Avoid too many return statements within this method.

Open

      return xml_doc_or_check_code unless success # in this case xml_doc_or_check_code is a CheckCode so we can return it directly

Avoid too many return statements within this method.

Open

    return [false, xml_doc_or_msg] unless success # this is only used for cleanup. for exploit this cannot happen

Avoid too many return statements within this method.

Open

        return [false, 'Failed to deescalate privileges. Manual cleanup is required.']

Avoid too many return statements within this method.

Open

          return [true]

Avoid too many return statements within this method.

Open

        return deal_with_failure_by_mode(mode, "Failed to parse the users.xml file while attempting to #{deescalate ? 'deescalate' : 'escalate'} privileges: #{e}", 'unexpected_reply')

Avoid too many return statements within this method.

Open

        return deal_with_failure_by_mode(mode, "Received unexpected reply while attempting to #{deescalate ? 'deescalate' : 'escalate'} privileges", 'unexpected_reply')

Avoid too many return statements within this method.

Open

    return [false, privs_or_msg] unless success

Avoid too many return statements within this method.

Open

      return

Avoid too many return statements within this method.

Open

      return CheckCode::Unknown("Failed to obtain a valid OpenNMS version: #{e}")

Avoid too many return statements within this method.

Open

      return CheckCode::Safe("User #{username} does not have the required privileges for exploitation to work.")

Avoid too many return statements within this method.

Open

          return deal_with_failure_by_mode(mode, message, 'unexpected_reply')

Avoid too many return statements within this method.

Open

    return privs_or_check_code unless success

Avoid too many return statements within this method.

Open

        return CheckCode::Appears("User #{username} has the required privileges for exploitation to work without privilege escalation.")

Avoid too many return statements within this method.

Open

      return [false, "Received unexpected response while attempting to trigger the notification. The payload likely wasn't executed."]

Avoid too many return statements within this method.

Open

      return [true, "Successfully deescalated privileges by removing #{@role_to_add}"]

Avoid too many return statements within this method.

Open

        return [true, 'Received expected response while triggering the payload. Please be patient, it may take a few seconds for the payload to execute.']

Avoid too many return statements within this method.

Open

            return [false, 'Failed to parse the users.xml file while attempting to deescalate privileges. Manual cleanup is required.']

Avoid too many return statements within this method.

Open

        return deal_with_failure_by_mode(mode, message, 'unexpected_reply')

Avoid too many return statements within this method.

Open

      return [false, message] unless success # this is only used for cleanup. for exploit this cannot happen

Similar blocks of code found in 2 locations. Consider refactoring.

Open

      if find_element_via_at_css(file_name)
        full_element = xml_doc_or_msg.at_css(root_element).css(element).find { |e| e.at_css('name')&.text == element_to_remove }
      else
        full_element = xml_doc_or_msg.at_css(root_element).css(element).find { |e| e['name'] == element_to_remove }

• Read up
  Read up

Similar blocks of code found in 2 locations. Consider refactoring.

Open

    if find_element_via_at_css(file_name)
      full_element = xml_doc.at_css(root_element).css(element).find { |e| e.at_css('name')&.text == new_value }
    else
      full_element = xml_doc.at_css(root_element).css(element).find { |e| e['name'] == new_value }

• Read up
  Read up