Serv_U password read stored in the registry

I am not familiar with The servu ftp Elevation of Privilege vulnerabilities. I will not mention these vulnerabilities because we all know how to use them. Many servu Elevation of Privilege tools are not introduced anymore. here, we only need to introduce the local solution of servu:

1. Modify the password of the local SERVU (many servers have not changed the password)
2. Disable the workstation service. In this way, you cannot escalate permissions. The server is in beta testing, but you do not know the reason!
3. Save The SERVU password in the registry.

These three methods are unreliable and need to be studied by multiple parties.

This article describes how to read the password stored in the registry !!
Because the current VM vendors are afraid of the serv-u Local Privilege Escalation Vulnerability, many of their administrators Store Passwords in the registry.

In webshell, run the following command:

Regedit/e "C: Documents and SettingsAll UsersDocumentssystem. ini "" HKEY_LOCAL_MACHINESOFTWAREcat softserv-u "will export all the serv-u account passwords in the Registry to C: Documents and SettingsAll UsersDocumentssystem. in the ini file, of course, the premise is: C: Documents and SettingsAll UsersDocuments folder is writable. If you cannot write, change the directory you can write. then download system. INI File

Open the password in plain text!
Now, let's get started with the following !!