androidteacher/cve-2026-24061-poc-telnetdProof-of-concept exploit for CVE-2026-24061, an unauthenticated remote root privilege escalation in inetutils-telnetd via USER environment variable manipulation. Includes Docker lab setup and reverse shell payload.
This repository contains a Proof-of-Concept (PoC) exploit for CVE-2026-24061. It is intended strictly for educational purposes and for testing systems in a controlled lab environment.
The author takes no responsibility for any misuse of this code.
This vulnerability affects inetutils-telnetd and allows an unauthenticated remote attacker to gain root privileges by manipulating the USER environment variable.
For a detailed analysis, please refer to the following research: Safebreach Labs Root Cause Analysis
A Docker image has been prepared to safely simulate the vulnerable environment.
Run the vulnerable container:
docker run -d -p 23:23 --name vulnerable-telnetd joshbeck2024/ctf-cve-2026-24061-telnetd
Note: This binds the vulnerable service to port 23 on your host. Ensure you are on a isolated network.
Edit the exploit script:
Update exploit.py with the target IP address.
exploit("TARGET_IP", 23)
Run the exploit:
python3 exploit.py
Result: If successful, the script will establish a reverse shell connection to the listener you configure within the script (or print the flag if using the default check).
Stay Ethical. Stay Safe.