ilokaas/cve-2026-24061-payloadA PoC exploit for CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass
Original source:https://github.com/K3ysTr0K3R/CVE-2026-24061
GNU InetUtils versions 1.9.3 through 2.7 are vulnerable to a remote authentication bypass vulnerability in the telnetd server. The telnetd daemon fails to properly sanitize the USER environment variable before passing it as a command line argument to the login(1) program. When a telnet client sends a USER environment variable containing command line flags (such as -f root), telnetd directly passes this unsanitized value to the login program. The login utility interprets the -f flag as an instruction to bypass authentication, allowing an attacker to gain unauthorized root access without providing any credentials.
Full Telnet Protocol Implementation
DO, DONT, WILL, and negotiations.WONTAutomatic Payload Injection
ENVIRON option payload with the USER=-f root injection.Interactive Shell
Connection Management
Verbose Debugging
python3 exploit.py <target> -p <port> [options]
| Argument | Description |
|---|---|
target | Target IP address or hostname |
| Option | Description |
|---|---|
-p, --port | Target port (default: 23) |
-v, --verbose | Enable verbose debug output |
-t, --timeout | Connection timeout in seconds (default: 5) |
-k, --keepalive | Keepalive interval in seconds (default: 30) |
-h, --help | Display the help message |
python3 exploit.py 192.168.1.100
python3 exploit.py 192.168.1.100 -p 2323 -v
python3 exploit.py 10.0.0.5 -p 2323 -k 60 -t 10
Connection Establishment
Protocol Negotiation
SGA, ECHO, and ENVIRON).Payload Delivery
WILL ENVIRON followed by the crafted subnegotiation payload.Authentication Bypass
-f root argument is injected into login(1) to bypass credential checks.Interactive Session
The exploit leverages the ENVIRON Telnet option (RFC 1572) to inject command-line arguments into the USER environment variable.
When telnetd passes this unsanitized value to login -f root, the login program interprets -f as a flag that forces authentication bypass, granting root access without password verification.
The exploit script implements:
WILL, WONT, DO, DONT)NOP commands to maintain session stability$ python3 exploit.py 127.0.0.1 -p 2323
[!] Coded By: K3ysTr0K3R
[*] Telnet Authentication Bypass
[*] Connecting to 127.0.0.1:2323
[+] Connection established
[+] Exploit payload sent (19 bytes)
# id
uid=0(root) gid=0(root) groups=0(root)
# whoami
root
#
System administrators can detect exploitation attempts by monitoring for:
ENVIRON option negotiation.USER environment variables containing -f or other command-line flags.Upgrade to GNU InetUtils version 2.8 or apply the official security patch that sanitizes environment variables before passing them to login(1).
This proof of concept is intended for security research, vulnerability validation, and authorized testing environments only. Use only against systems for which you have explicit permission to perform security assessments.