I am practicing directory traversal attacks and found a vulnerability in a windows XP machine that is running a vulnerable HTTP server that is prone to directory traversal.
I can guess file names and read them successfully but can not execute commands. What are available options to execute code on the box?
I got a copy of /repair/sam however, it was not that much useful since I do not have access to system hives ! The most i could get is the user names of the system.
So any thoughts how to escalate this to get full access?
Hints: only ports 80 and 3389 are open.