| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. War Crypter.rar GuideA graphical interface that allows the user to select a file, choose encryption methods, and apply obfuscation. The prefix "War" in software names like "War Crypter" often signifies its intended use in or offensive operations. These tools are frequently used by: In the context of cybersecurity, a is a specialized utility designed to hide the true nature of a file (the "payload"). Typically, these tools are distributed in compressed formats like .rar or .zip and consist of two primary components: War Crypter.rar Ethical hackers who use these tools during authorized security audits to test how well an organization’s defenses can detect sophisticated, obfuscated threats. Security Vulnerabilities in Archive Formats To protect ransomware or banking trojans from being "signatured" by security software. A graphical interface that allows the user to The delivery of such tools in .rar format is itself a security consideration. Recently, critical vulnerabilities like have been discovered in archive managers like WinRAR . These flaws can allow an attacker to execute a hidden payload just by having a user open or extract a malicious archive, turning the container itself into a weapon. Organizations are strongly advised to keep software updated to the latest versions (e.g., WinRAR 7.13+ ) to mitigate these risks. Ethical and Legal Implications The possession and use of "crypters" fall into a legal gray area. While they can be used for legitimate software protection (to prevent reverse engineering of intellectual property), they are overwhelmingly associated with the creation of undetectable malware (FUD—Fully Undetectable). In many jurisdictions, the use of such tools to facilitate unauthorized access to a computer system is a serious criminal offense under laws like the in the U.S. or the Computer Misuse Act in the UK. Typically, these tools are distributed in compressed formats A small piece of code attached to the encrypted file that decrypts and executes the payload in memory when the file is opened, often bypassing traditional disk-based antivirus scans. Strategic Use and "War" Context
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |