CyberHawks lab demo finding report

Credit to: @SafeBreach-Labs

CVE: CVE-2026-24061

Lab: Cyberhawks Lab
Target: 10.1.1.1 (demo.cyberhawks.lab)
Finding ID: WU-08
Date: 2026-09-08
Severity: Critical
Status: Confirmed / Exploited

Executive Summary

During an assessment of the Cyberhawks lab environment, an unauthenticated Remote Code Execution (RCE) vulnerability was identified and successfully exploited on the target host (10.1.1.1). Exploitation of CVE-2026-24061 via an exposed Telnet service (TCP/23) resulted in a root-level interactive shell, granting full administrative control over the system.

Scope & Environment

Reconnaissance

Port Scan

An Nmap service version scan was performed against the target to enumerate open ports and services.

Command:

nmap -sV 10.1.1.1

Results Summary:

Notable Observations:

• The host exposes a broad and concerning attack surface across 15 ports.
• Port 23 (Telnet) was accessible, making it an immediate priority target.
• The presence of Telnet — an inherently insecure, cleartext protocol — on any modern host represents a critical misconfiguration. It's likely that the service version is exploitable.

Vulnerability Details

Description

CVE-2026-24061 is an unauthenticated Remote Code Execution vulnerability affecting the Telnet daemon component of GNU inetutils 2.6. Exploitation allows a remote, unauthenticated attacker to execute arbitrary commands on the target system with the privileges of the running service — in this case, root.

Exploitation

Tool / Exploit Used

A purpose-built Python exploit script (telnet_rce.py) targeting CVE-2026-24061 was executed against the vulnerable Telnet service.

Command:

python3 telnet_rce.py 10.1.1.1

Exploit Output:

[*] Connected to 10.1.1.1:23
[*] Interactive session started. Use Ctrl+C to quit.

Linux 6.12.41+deb13-amd64 (demo.cyberhawks.lab) (pts/0)

root@demo:~#

Post-Exploitation Verification

Upon obtaining a shell, the following commands confirmed the level of access achieved:

Identity Verification:

root@demo:~# id
uid=0(root) gid=0(root) groups=0(root)

Filesystem Enumeration:

root@demo:~# ls -la
total 36
drwx------  6 root root 4096 Aug 28 14:47 .
drwxr-xr-x 19 root root 4096 Aug 28 15:37 ..
-rw-r--r--  1 root root  607 May 12  2025 .bashrc
drwx------  4 root root 4096 Sep  6  2025 .cache
drwxr-xr-x  3 root root 4096 Sep  6  2025 .config
drwxrwxr-x  3 root root 4096 Sep  6  2025 .local
-rw-------  1 root root  261 Sep  6  2025 .mariadb_history
-rw-r--r--  1 root root  132 May 12  2025 .profile
drwx------  2 root root 4096 Sep  6  2025 .ssh

Service Version Verfication

root@demo:~# telnet --version

telnet (GNU inetutils) 2.6
Copyright (C) 2025 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.

Key findings from post-exploitation:

• .mariadb_history — indicates active MariaDB database usage; potential for further credential harvesting or data exfiltration.
• .ssh/ directory — may contain private keys usable for lateral movement to other hosts.
• Full root (UID 0) access was confirmed with no privilege escalation step required.

Impact

Full system compromise was achieved in a single, unauthenticated step. An attacker with access to this network segment could:

• Read, modify, or exfiltrate all data stored on the host.
• Harvest credentials from shell history, config files, and the MariaDB database.
• Use SSH keys to pivot laterally to other hosts on the network.
• Establish persistence (e.g., backdoor accounts, cron jobs, rootkits).
• Disrupt availability of all services running on the host.

Recommendations

Immediate (Critical Priority)

1. Patch or mitigate CVE-2026-24061 — Apply the vendor-supplied patch for GNU inetutils if Telnet must remain in use. Check for an updated package:
   root@kitploit:~

   apt update && apt install inetutils-telnetd
   

Artifacts & Evidence

Report prepared for Cyberhawks Lab — educational use only.