| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Office-2013-2024-c2r-install-7.7.7.7---lite.zip May 2026While the filename Office-2013-2024-C2R-Install-7.7.7.7---Lite.zip might promise simplicity and cost savings, engaging with such a tool invites legal liability, data theft, and system instability. The risks far outweigh any perceived benefit. Users seeking productivity software should always obtain it directly from the publisher or authorized resellers. In the digital world, if a solution seems too convenient and free—especially when it bypasses paid software—it is almost certainly a trap. Beyond legal and security issues, these tools frequently lead to technical problems: broken updates, activation “time bombs” (where the license suddenly deactivates), and conflicts with genuine Office installations. Since the tool modifies registry entries and Windows services like the Software Protection Platform, standard uninstallation may leave residual components, causing errors when attempting to install legitimate Office later. Office-2013-2024-C2R-Install-7.7.7.7---Lite.zip It is important to clarify that refers to a third-party tool (often discussed on software forums) designed to deploy, customize, or activate Microsoft Office suites. This essay will examine the tool’s stated purpose, its technical context, and the significant legal and security concerns it raises. The Allure and Danger of Unofficial Office Deployment Tools: A Case Study of “C2R Install” In an era where productivity software is essential but often expensive, many users seek alternative methods to obtain or manage applications like Microsoft Office. One such tool, frequently archived under filenames like Office-2013-2024-C2R-Install-7.7.7.7---Lite.zip , promises flexible installation of Office versions from 2013 to 2024 using the “Click-to-Run” (C2R) streaming technology. While the utility may appear convenient, a closer examination reveals substantial technical, ethical, and cybersecurity risks. While the filename Office-2013-2024-C2R-Install-7 Microsoft’s End-User License Agreement (EULA) strictly prohibits modifying, reverse-engineering, or circumventing its activation mechanisms. Using a third-party tool to install Office without a valid, purchased license constitutes software piracy. Even if the user owns a license, employing an unauthorized installer can violate support terms. Distributing such a ZIP file—often on torrent sites or file lockers—enables mass copyright infringement. Microsoft has pursued legal action against creators of similar “KMS” or “C2R” activators, deeming them illegal under the Digital Millennium Copyright Act (DMCA) and international IP law. In the digital world, if a solution seems At its core, C2R Install utilities are unofficial front-ends for Microsoft’s own Office Deployment Tool (ODT). They allow users to select specific Office products (Word, Excel, PowerPoint), choose update channels, and optionally bypass license checks. The “Lite” version (7.7.7.7) suggests a stripped-down interface with a focus on core installation or activation functions. Proponents argue such tools are useful for IT administrators testing legacy versions or for users needing offline installers. However, the inclusion of “2013-2024” indicates support for both outdated and unreleased (at the time of naming) suites, hinting at modification of Microsoft’s original code.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |