| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Okhatrimazacom Hollywood 2008 -But that era is over. The demand that drove "okhatrimazacom" searches—access, speed, and variety—has been met and surpassed by legal streaming services. While the search term still gets traffic from nostalgic users and automated bots, the reality is grim: the sites are dangerous, the quality is ancient, and the legal alternatives are cheap and abundant. So, appreciate 2008. It was a fantastic year for cinema. But watch those movies on a proper screen, in proper quality, from a proper source. Leave Okhatrimaza in the digital graveyard where it belongs. Disclaimer: This article is for informational and educational purposes only. Piracy is illegal in most jurisdictions. Always access content through licensed distributors such as Netflix, Prime Video, Disney+, or local DVD/Blu-ray purchases. okhatrimazacom hollywood 2008 In the sprawling, chaotic, and largely unregulated history of online movie piracy, certain keywords act like digital archaeology—keywords that unlock a very specific era of bandwidth limits, RealPlayer files, and the transition from DVD to Blu-ray. One such string of text that still echoes in niche forums, old hard drives, and SEO query logs is "okhatrimazacom hollywood 2008." But that era is over At first glance, it looks like a typo or a broken URL. But for a generation of film fans from the late 2000s, this keyword represents a specific gateway to a specific year in cinema. Let’s break down what this term means, why 2008 was a landmark year for Hollywood, and how Okhatrimaza (and its various domain shifts) became a controversial pillar of the free-content ecosystem. The term "Okhatrimaza" (often misspelled as Okhatrimazacom) is a derivative of a more notorious piracy brand: Khatrimaza . Khatrimaza was an infamous Indian piracy website that specialized in leaking Bollywood, Hollywood, and regional films. The "O" prefix is likely a phonetic or typographical variation—either a mirror domain (e.g., Okhatrimaza.com) or a search engine mishearing. So, appreciate 2008
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |