FTPService.exe is a service-version of Pablo's FTP Server. This service
enables you to have the FTP server active even when you're not logged
The anonymous account is by default set to have download access to anything
in the C:\ directory. While this can be disabled by simply deleting the
anonymous account, it poses a serious threat for anyone not aware of the
In conclusion this application is totally open to complete compromise by default.
Vendor was notified and plans on releasing a fix soon.
Plaintext Password Weakness:
User info is stored in users.dat in plaintext. If the anonymous account is present
(it is by default) the entire FTP server can be compromised
ftp://somewhere/program files/pablo's ftp service/users.dat
Upgrade your version of Pablo FTP Service.
James Bercegay of the GulfTech Security Research Team.