CVE-2026-24061

CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass

GNU InetUtils versions 1.9.3 through 2.7 are vulnerable to a remote authentication bypass vulnerability in the telnetd server. The telnetd daemon fails to properly sanitize the USER environment variable before passing it as a command line argument to the login(1) program. When a telnet client sends a USER environment variable containing command line flags (such as -f root), telnetd directly passes this unsanitized value to the login program. The login utility interprets the -f flag as an instruction to bypass authentication, allowing an attacker to gain unauthorized root access without providing any credentials.

Features

• Full Telnet Protocol Implementation

  • Handles DO, DONT, WILL, and WONT negotiations.
  • Supports subnegotiation parsing and keepalive mechanisms.

• Automatic Payload Injection

  • Constructs and sends the crafted ENVIRON option payload with the USER=-f root injection.

• Interactive Shell

  • Provides a bidirectional interactive session for command execution.

• Connection Management

  • Implements socket keepalive, timeout handling, and graceful session cleanup.

• Verbose Debugging

  • Optional debug output for protocol analysis and troubleshooting.

Usage

python3 exploit.py <target> -p <port> [options]

Required Arguments

Optional Arguments

Examples

Exploit the default Telnet port

python3 exploit.py 192.168.1.100

Exploit a custom port with verbose output

python3 exploit.py 192.168.1.100 -p 2323 -v

Use an extended keepalive interval for unstable connections

python3 exploit.py 10.0.0.5 -p 2323 -k 60 -t 10

Exploit Workflow

1. Connection Establishment

   • Initiates a TCP connection with appropriate socket options and keepalive settings.

2. Protocol Negotiation

   • Handles Telnet option negotiation (SGA, ECHO, and ENVIRON).

3. Payload Delivery

   • Sends WILL ENVIRON followed by the crafted subnegotiation payload.

4. Authentication Bypass

   • The -f root argument is injected into login(1) to bypass credential checks.

5. Interactive Session

   • Provides full bidirectional shell access with real-time command execution.

Technical Details

The exploit leverages the ENVIRON Telnet option (RFC 1572) to inject command-line arguments into the USER environment variable.

When telnetd passes this unsanitized value to login -f root, the login program interprets -f as a flag that forces authentication bypass, granting root access without password verification.

Protocol Handling

The exploit script implements:

• IAC (Interpret As Command) byte escaping
• Subnegotiation parsing and construction
• Option negotiation responses (WILL, WONT, DO, DONT)
• Keepalive NOP commands to maintain session stability

Example Output

$ python3 exploit.py 127.0.0.1 -p 2323

[!] Coded By: K3ysTr0K3R
[*] Telnet Authentication Bypass
[*] Connecting to 127.0.0.1:2323
[+] Connection established
[+] Exploit payload sent (19 bytes)

# id
uid=0(root) gid=0(root) groups=0(root)

# whoami
root

#

Requirements

• Python 3.7 or later
• No external dependencies
• Uses only the Python standard library

Detection and Mitigation

System administrators can detect exploitation attempts by monitoring for:

• Telnet connections performing ENVIRON option negotiation.
• USER environment variables containing -f or other command-line flags.
• Authentication bypass events in system logs.

Mitigation

Upgrade to GNU InetUtils version 2.8 or apply the official security patch that sanitizes environment variables before passing them to login(1).

Disclaimer

This proof of concept is intended for security research, vulnerability validation, and authorized testing environments only. Use only against systems for which you have explicit permission to perform security assessments.