CWD ~root command in ftpd allows root access.
https://github.com/i-mAshura/ExploitOracle
https://github.com/Mujtaba11Riu/Operating-System-Project
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-0082
http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html