| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Work Updated | Download Wordlist Github: Used for password cracking and brute-force testing (e.g., RockYou ). For professionals, one repository stands as the undisputed king of aggregation: . But searching for "download wordlist github work" often leads beginners down a rabbit hole of broken links, terminal errors, and confusion about what to do with a .txt file once they finally get it. The most comprehensive collection for all types of security testing. : To grab an entire repository of lists at once, use: git clone https://github.com Use code with caution. Copied to clipboard Wget/Curl : To download a specific raw file via terminal: wget https://githubusercontent.com Use code with caution. Copied to clipboard split -l 500000 huge_wordlist.txt chunk_ download wordlist github work Ultimate Guide to GitHub Wordlists for Security Testing and Automation This command performs a straight dictionary attack ( -a 0 ) on MD5 hashes ( -m 0 ) using rockyou.txt as the wordlist. Trying to brute-force an RDP with a 50GB file? The network will drop. Split the list. If you only need a single file, navigate to the file on GitHub, click the button, copy the URL, and use the command line. wget https://githubusercontent.com Use code with caution. Method 3: GitHub Web Interface Navigate to the desired wordlist file. Click the Raw button in the top right of the file view. : Used for password cracking and brute-force testing (e Incorporate automatic downloads directly into your security tool chains and reconnaissance workflows. The Ultimate Guide to GitHub Wordlists for Security Testing and Automation GitHub has emerged as the central hub for cybersecurity wordlists, offering an unparalleled resource for penetration testing, password security audits, and security research. Whether you are performing a dictionary attack with Hashcat, fuzzing web endpoints with ffuf, or conducting a comprehensive security assessment, having access to the right wordlist can dramatically improve your efficiency. This guide explores the best GitHub wordlist repositories, the most effective methods to download them, and how to integrate them into your professional workflow. : Large wordlists used in aggressive directory busting or brute-forcing can cause Denial of Service (DoS) conditions or lock out legitimate users. Always tune your tool's speed and thread count to match the target environment's capacity. To help customize your setup, tell me: The most comprehensive collection for all types of Assetnote provides automated, regularly updated wordlists generated from massive internet-wide scans. Many wordlists from GitHub don't end with a newline, causing scripts to miss the last password. The carlospolop/Auto_Wordlists project offers automated dictionary generation for web fuzzing, DNS resolvers, and Google hacking database (GHDB) payloads, using bash or Python scripts to retrieve, deduplicate, and format outputs into optimized .txt files. Her target today: a client’s legacy web portal that had survived three rounds of standard testing. She knew she needed something more specific than a generic dictionary. She navigated to , the heart of the security community, searching for something specialized.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |