Format String Vulnerability in IPCOMShell TELNET server (INTEGRITY RTOS 5.0.4)

Small repository with 3 files: two Markdown documents and one Python exploit script. The main code is exploit.py, a standalone Python Telnet exploit that connects to a target on TCP/23, waits for a 'login:' prompt, submits hardcoded credentials ('admin' / 'password'), and then sends format-string payloads through a 'prompt' command. The first payload uses repeated %p specifiers to leak memory addresses; the second uses %n (%2500c%35$n) to attempt an arbitrary write and possible control-flow hijack. The script then sends 'exit' and 'reboot', suggesting an attempt to trigger the corrupted state or complete the exploit chain. The code is incomplete/malformed near the end, but its intended capability is clear and offensive rather than diagnostic. README.md documents CVE-2019-7711 as a format-string information leak in the Green Hills INTEGRITY RTOS 5.0.4 IPCOMShell/Telnet service, describing exploitation via Telnet and unsafe printf handling. Use.md appears to discuss a different Telnet-related memory corruption concept involving SLC triplets and buffer geometry; it does not match the Python exploit directly and looks like supplemental or mixed research notes rather than code used by exploit.py. Overall, this repository is a proof-of-concept/operational exploit repo targeting a network-accessible Telnet service, primarily focused on memory disclosure and attempted write-primitive exploitation against Green Hills INTEGRITY RTOS-related Telnet functionality.

The repository is very small and consists of a README plus a single Python entry-point script, exploit.py. The script is a standalone network exploit targeting CVE-2019-7711 in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. It is not part of a larger exploit framework. Operationally, the exploit uses telnetlib to connect to a user-supplied target on TCP/23, waits for a 'login:' prompt, and authenticates with hardcoded credentials ('admin' / 'password'). It then sends a format-string payload through the IPCOMShell 'prompt' command. Phase 1 attempts a broad memory disclosure using repeated %p, %x, and %s specifiers, followed by additional shell commands ('pwd', 'show tasks', 'help') to generate output that is then read back and printed for manual analysis. Phase 2 sends a fixed write payload ('%2500c%35$n') intended to exercise a %n arbitrary-write primitive. Phase 3 sends 'exit' and 'reboot' as trigger commands in an attempt to activate corrupted state or hijacked control flow. The code demonstrates exploit intent beyond simple detection, but it remains relatively basic and partially manual: offsets are hardcoded, leak analysis is left to the operator, and the parsed --lhost/--lport options are unused, so there is no implemented reverse shell or second-stage payload. As written, it is best characterized as an operational PoC for remote TELNET-based format-string exploitation against a vulnerable maintenance interface.