AbsoluteTelnet 10.14 DLL Hijacking

`[+] Credits: hyp3rlinx  
  
[+] Website: hyp3rlinx.altervista.org  
  
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/ABSOLUTETELNET-DLL-HIJACK.txt  
  
  
  
Vendor:  
==========================  
www.celestialsoftware.net  
  
  
  
Product:  
=====================  
AbsoluteTelnet 10.14  
  
AbsoluteTelnet / SSH is a telnet and SSH client with SFTP file transfer for  
Windows.  
  
  
  
Vulnerability Type:  
=========================  
DLL Hijack Code Execution  
  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
Vulnerability Details:  
=====================  
  
AbsoluteTelnet will execute arbitrary code via DLL "stauto32.dll" from CWD  
or if placed in certain locations... e.g. Desktop etc...  
  
When AbsoluteTelnet installs it creates a shortcut in the start list under  
start run with an empty "Start" field under the properties for the shortcut.  
If a user drags this shortcut to desktop or creates a new one, and DLL  
named "stauto32.dll" exists in this case on desktop. The DLL will be  
executed when  
AbsoluteTelnet is run. Other scenarios may include connecting to or opening  
documents from a network share where an attacker has compromised that share.  
  
  
Reference:  
http://www.celestialsoftware.net/absolutetelnet-ssh-client/absolutetelnet/ssh-version-history-9.53.html  
  
Users should upgrade to version 10.15  
  
POC steps...  
  
1- create malicious DLL "stauto32.dll" place in Desktop  
2- run vulnerable AbsoluteTelnet version from shortcut sent to desktop  
3- arbitrary DLL code executed  
  
  
  
Disclosure Timeline:  
=====================================  
Vendor Notification: Feb 23, 2016  
Vendor confirms vulnerability  
Vendor releases fixed version 10.15  
March 20, 2016 : Public Disclosure  
  
  
  
  
Severity Level:  
================  
High  
  
  
  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory,  
provided that it is not altered except by reformatting it, and that due  
credit is given. Permission is explicitly given for insertion in  
vulnerability databases and similar, provided that due credit is given to  
the author.  
The author is not responsible for any misuse of the information contained  
herein and prohibits any malicious use of all security related information  
or exploits by the author or elsewhere. All Content is (c) of hyp3rlinx.  
  
hyp3rlinx  
`