Buffer Overflow in telnetd (libtelnet/encrypt.c)

This repository contains a single Metasploit module that exploits a buffer overflow vulnerability (CVE-2011-4862) in the encryption option handler of the FreeBSD telnet service. The exploit targets multiple versions of FreeBSD (5.3 through 8.2) where the telnet service is running with encryption enabled. The module connects to the target's telnet service over the network, negotiates encryption, and sends a specially crafted Key ID suboption to trigger a buffer overflow, allowing for arbitrary code execution as a privileged user. The payload is customizable via Metasploit and typically results in a shell on the target system. The code is written in Ruby and follows the standard Metasploit module structure, leveraging the framework's payload and handler mechanisms. The only fingerprintable endpoint is the network-exposed telnet service on the target FreeBSD system.

This repository contains a single Metasploit module: 'telnet_encrypt_keyid.rb', which exploits a buffer overflow vulnerability (CVE-2011-4862) in the encryption option handler of certain BSD-derived telnetd services on Linux (specifically inetutils or krb5-telnet, not the more common NetKit-derived telnetd). The exploit works by sending specially crafted telnet encryption suboption commands, overflowing a buffer in the Key ID handler, and injecting a customizable payload. The module is operational and provides remote code execution as a privileged user if the target is vulnerable. The only fingerprintable endpoint is the telnet service (typically TCP port 23) on the target system. The code is written in Ruby and is structured as a standard Metasploit exploit module, with all logic contained in a single file.

This repository contains a Go-based exploit for CVE-2011-4862. The structure includes a main entry point (main.go) and the exploit logic (exploit.go). The exploit is executed by providing a target IP address and port as command-line arguments. It establishes a TCP connection to the target and sends a specially crafted payload that includes shellcode to execute /bin/sh, aiming to provide the attacker with an interactive shell on the target system. The exploit is operational, with a hardcoded shellcode payload and basic interactive shell functionality. No specific product is mentioned, but the exploit is designed for a network service vulnerable to CVE-2011-4862. No hardcoded IPs or domains are present; the target is specified at runtime.