Authentication Bypass in GNU Inetutils telnetd via USER Argument Injection

This repository is a small, self-contained proof-of-concept exploit and lab environment for CVE-2026-24061, an authentication bypass affecting inetutils telnetd. The main exploit logic is in auth-bypass.py, a Python 3.12 script using telnetlib3. It sets the local USER environment variable to '-f root' and opens a TELNET connection with send_environ=('USER',), causing the client to transmit that value during TELNET environment negotiation. The stated goal is to exploit vulnerable telnetd authentication handling and obtain a root session without credentials. Repository structure is minimal: auth-bypass.py is the exploit; Containerfile builds a Debian-based vulnerable target with xinetd and inetutils-telnetd installed, exposing TELNET on port 23; run.sh builds and runs the container with Podman and maps localhost:2323 to container port 23; shell.sh provides an administrative shell into the running container; README.md briefly documents the purpose. This is not part of a larger exploit framework. Operationally, the exploit is network-based and targets a TELNET service. It does not include a post-exploitation payload beyond establishing an interactive session through telnetlib3's client shell. The included container setup strongly indicates the repository is intended both to demonstrate and reproduce the vulnerability locally rather than to provide broad automation, scanning, or stealth features.

Repository is a small standalone Python exploit/scanner project consisting of a single executable script (abyssal.py), a README, and a license. The script is the main entry point and implements a multi-threaded Telnet scanner targeting a claimed GNU InetUtils telnetd vulnerability identified as CVE-2026-24061. It accepts a file of targets, supports default Telnet port 23 and custom per-target ports, uses configurable thread count and timeouts, writes timestamped logs, and tracks result buckets including vulnerable, protected, failed, unreachable, and false positives. The code imports socket, threading, concurrent.futures, and pexpect, indicating a combination of raw network connectivity checks and interactive session automation. README and visible code indicate that successful exploitation can transition into an operator-controlled interactive shell, making this more than a pure detector. No hardcoded victim infrastructure, C2, or external callback endpoints are present; targeting is operator-driven from a local input file. Based on the available content, this is a standalone operational exploit/scanner for Telnet services rather than a framework module.

Small Python exploit repository centered on a single script, main.py, with supporting README and minimal pyproject metadata. The exploit is a standalone network-based Telnet authentication bypass PoC/operational script targeting GNU inetutils-telnetd and claiming CVE-2026-24061. Its core capability is to connect to a Telnet service, participate in Telnet option negotiation, and when the server requests NEW_ENVIRON data, send a crafted USER environment variable containing '-f <user>' (default 'root') to bypass authentication. The script also handles TTYPE and TSPEED negotiation by replying with 'xterm' and '38400,38400' respectively, which helps establish a usable interactive session. Operationally, the script supports single-target mode (-u) and bulk mode (-l) where it reads hosts from a file and launches one thread per target. It accepts a custom port (-p, default 23) and custom username (-usr). Based on the visible code and README, successful exploitation is intended to yield an unauthenticated shell on the remote host as the specified user, typically root. This is not a detection-only tool; it actively sends exploit traffic and attempts to maintain an interactive Telnet session. Repository structure is minimal: README.md provides vulnerability narrative, usage, and references; main.py contains all exploit logic; pyproject.toml only defines package metadata; .python-version pins the interpreter version. No external C2, callback infrastructure, hardcoded victim IPs, or persistence mechanisms are present in the visible content. The main fingerprintable target is the Telnet service on TCP/23 and the specific Telnet NEW_ENVIRON negotiation sequence carrying USER='-f <user>'.

Repository contains two Python scripts with distinct purposes. The primary exploit is main.py, a multithreaded Telnet exploitation tool. It reads targets from a user-supplied file, connects to each host over Telnet, sends Telnet negotiation bytes and a crafted NEW-ENVIRON payload that sets USER=-f root, then attempts post-exploitation commands (id, whoami, uname -a, pwd). If output indicates uid=0 or root, it records the host as vulnerable and opens an interactive Telnet session. This is a real exploit, not merely a detector, because it actively attempts privilege escalation and interactive shell access. The exploit is operational but not framework-based; payloads are hardcoded and basic. main.py structure: save_vulnerable_targets() writes successful targets to vulnerable.txt; exploit_target() performs the Telnet connection, payload delivery, verification, and optional interaction; parse_targets() parses host[:port] entries from an input file; load_previous_vulnerable() reloads prior results; main() orchestrates concurrent exploitation with ThreadPoolExecutor. The secondary script, k.py, is not part of the exploit itself. It is a utility that parses JSON or text containing fields like ip_str, port, timestamp, ISP, location, telnet options, hostnames, and ASN, then exports extracted IPs to text and JSON files. This suggests the repository workflow may involve harvesting candidate Telnet targets from external scan data and then feeding them into main.py. No hardcoded external C2, callback, or download URLs are present. Network targeting is entirely operator-supplied via hostnames/IPs, with default Telnet TCP/23 and optional custom ports. The repository overall is a small offensive toolkit for identifying and exploiting vulnerable Telnet services that mishandle environment-variable negotiation to yield root access.

This repository is a small standalone exploit PoC consisting of a README and a single Python script, telnetd.py. The Python code is the operative exploit: it uses Python's telnetlib to connect to a user-supplied host and optional port (default 23), sends raw Telnet negotiation bytes, then sends a crafted NEW-ENVIRON subnegotiation payload that defines the USER variable as '-f root'. After a short delay, it invokes tn.interact() to hand the session to the operator, implying expected unauthenticated shell access. The exploit capability is therefore remote network-based authentication bypass with interactive shell access, and the intended outcome is root-level access. Repository structure is minimal and purpose-built. README.md provides the vulnerability narrative, affected versions, exploitation example, and remediation notes. telnetd.py is the only code file and serves as the entry point. There is no framework integration, no modularization, and no detection-only logic; this is a direct exploitation script. The exploit does not include post-exploitation automation beyond opening an interactive Telnet session, so it is best classified as OPERATIONAL rather than weaponized. Notable fingerprintable targets and artifacts include TCP/23 as the default network endpoint, the injected string 'USER=-f root', and target-side paths such as /bin/login and /usr/sbin/telnetd referenced in the README. Overall, the repository's purpose is to demonstrate and operationalize exploitation of the claimed GNU Inetutils telnetd authentication bypass identified as CVE-2026-24061.

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-24061, targeting GNU InetUtils telnetd. The repository contains one primary code file (CVE-2026-24061.py), a README describing the vulnerability and usage, and a requirements.txt that lists only standard-library modules. The exploit is not part of a larger framework. The Python script implements a Telnet client with explicit protocol handling rather than sending a single raw packet. It defines Telnet command/option constants, builds an ENVIRON subnegotiation payload, negotiates Telnet options, maintains session state, and appears to support reader/keepalive threads and an interactive shell session after exploitation. The key exploit primitive is generated in EnvironPayloadBuilder.build_exploit_payload(), which constructs a Telnet ENVIRON assignment for USER with the value '-f root'. According to the README and visible code, this is intended to exploit telnetd passing the USER environment variable unsafely to login(1), causing login to interpret -f root as an authentication-bypass flag. Main capabilities: establish a TCP Telnet connection to a target host, perform Telnet negotiation (DO/DONT/WILL/WONT, subnegotiation handling, NOP keepalives), deliver the malicious ENVIRON payload, and then provide an interactive post-exploitation shell if the bypass succeeds. This makes it more than a detector or minimal packet sender; it is an operational exploit with a hardcoded payload. Fingerprintable targets/endpoints are minimal because this is a client-side exploit against operator-supplied targets. The main network target is a user-provided host on TCP port 23 by default, with README examples using 2323 as an alternate port. Example IPs in documentation are 127.0.0.1, 192.168.1.100, and 10.0.0.5. The most important exploit-specific observable is the Telnet ENVIRON payload carrying USER=-f root, which defenders could detect in Telnet negotiation logs or packet captures. Overall purpose: exploit a remote Telnet authentication bypass in vulnerable GNU InetUtils telnetd versions by abusing ENVIRON-based argument injection to obtain unauthenticated root shell access.

Repository contains a small standalone exploit set for alleged CVE-2026-24061 targeting GNU inetutils-telnetd. There are 5 files total: metadata/support files (.gitignore, LICENSE, README.md) and two executable exploit implementations (exploit.py and exploit.sh). The Python and Bash versions implement the same core logic: connect to a remote telnet service over TCP, participate in telnet option negotiation, watch for subnegotiation on option 39 (NEW_ENVIRON), and then send a crafted payload that sets USER to '-f <username>' (default '-f root'). The stated goal is remote authentication bypass leading to an immediate shell. Main exploit capabilities include: single-host exploitation, batch exploitation from a target list file, configurable telnet port, configurable injected username, retry/delay/timeout controls, and interactive or piped command execution once a session is obtained. The Python version uses sockets, nonblocking I/O, select, and threading for concurrency; the Bash version mirrors this behavior with shell functions and argument parsing. The exploit is not merely a detector: it actively sends a malicious telnet negotiation payload intended to alter authentication behavior and obtain shell access. Fingerprintable targets/endpoints are minimal because the exploit is operator-supplied rather than hardcoded to a campaign server. The primary network target is a telnet service on TCP/23 by default, with support for alternate ports. The repository references a local targets.txt file for mass exploitation and includes example post-exploitation commands such as reading /etc/passwd. No hardcoded C2, callback IPs, or exfiltration endpoints are present. Overall, this is an operational standalone network exploit/PoC repository with dual-language implementations focused on exploiting a telnet daemon authentication bypass via telnet NEW_ENVIRON negotiation abuse.

This repository is a small standalone Python exploit/scanner project centered on a single executable script, telnetd_scanner.py, plus a README and license. The script is not part of a larger exploit framework. Its purpose is to scan one or more Telnet targets and actively attempt exploitation of the claimed CVE-2026-24061 affecting GNU InetUtils telnetd. Core exploit logic is implemented in probe(). The script opens a TCP connection to the target, reads the Telnet banner, sends a WILL NEW-ENVIRON negotiation, then transmits a crafted NEW-ENVIRON subnegotiation containing USER=-f root. It interprets returned text for shell-like indicators such as '#', '$', 'root@', or 'uid=0', and for login failure prompts such as 'login:' or 'Password:'. If exploitation appears successful, it sends 'id' to verify command execution and marks the host as exploited when uid output is observed. Operationally, the tool supports scanning single hosts, hostnames, or CIDR ranges via expand(), and uses ThreadPoolExecutor for concurrent scanning. It includes progress display, verbose logging, and report generation in text or JSON. The report function summarizes vulnerable and exploited hosts and includes remediation guidance. Fingerprintable observables are limited and mostly target-side: TCP port 23, the Telnet NEW-ENVIRON negotiation, the injected string USER=-f root, and the verification command id. There are no hardcoded external C2 servers, callback URLs, or third-party network services. Overall, this is an operational active exploit scanner: it does not merely detect exposure, but attempts the bypass and validates shell access.

This repository is a small exploit toolkit targeting GNU InetUtils telnetd with two pre-authentication issues: CVE-2026-24061 and CVE-2026-32746. It contains 10 files total, primarily Python plus one Bash scanner wrapper. The main structure is: two primary exploit implementations in exploits/exploit_cve_2026_24061.py and exploits/exploit_cve_2026_32746.py; three focused PoC/support scripts for CVE-2026-32746 (exploit_heap_ptr.py, exploit_rce.py, exploit_slctab_crash.py); a bulk scanner in exploits/scanner.py; and a shell-based parallel scanner in scan_telnetd.sh. CVE-2026-24061 exploit: a network Telnet exploit against TCP/23 that abuses Telnet NEW-ENVIRON negotiation. The code negotiates Telnet options, responds to NEW-ENVIRON requests, and injects USER="-f root" (or a custom string) so telnetd passes it into /usr/bin/login as a command-line argument. The intended result is authentication bypass and an immediate pre-auth root shell. The script supports at least check mode and interactive shell mode, making it more than a detector. CVE-2026-32746 exploit: a more advanced Telnet LINEMODE/SLC overflow exploit framework. It crafts malicious SLC triplets in Telnet subnegotiation to overflow slcbuf and corrupt adjacent BSS state. Repository descriptions indicate multiple capabilities: crash verification, probing, pointer corruption, arbitrary-write style primitives, and target-specific RCE by overwriting GOT/function pointers. The main exploit file exposes multiple modes such as crash, probe, rce, and verify-rce, and requires target-specific offsets or profiles for reliable code execution. This makes it operational but not fully weaponized. The auxiliary CVE-2026-32746 scripts document and demonstrate exploitation stages: exploit_slctab_crash.py aims for controlled SIGSEGV via slctab corruption; exploit_heap_ptr.py demonstrates corruption of I/O buffer pointers to redirect writes; exploit_rce.py chains several primitives and explicitly assumes a fixed target layout (GNU inetutils telnetd 2.5, ASLR disabled, known binary/libc bases). These files are useful for exploit development and validation rather than generic one-click exploitation. The scanner.py script performs bulk scanning of targets from a file or stdin, checks TCP connectivity, invokes the exploit classes directly, and records whether CVE-2026-24061 yields RCE and whether CVE-2026-32746 appears vulnerable/crashable or RCE-capable. The Bash script scan_telnetd.sh wraps the two main Python exploits for parallelized scanning and CSV output. Overall, the repository’s purpose is offensive security research and validation of pre-auth Telnet daemon vulnerabilities, with both exploitation and scanning workflows centered on GNU inetutils telnetd over TCP port 23.

This repository is not a standalone exploit implementation but a vulnerable lab environment for practicing exploitation of CVE-2026-24061 against GNU InetUtils telnetd. The repo contains four files: a README describing the vulnerability and exploit syntax, a Vagrantfile that provisions a Debian Bookworm VM on a private host-only network (192.168.56.10), and a Bash provisioning script that installs and configures the vulnerable service. The main operational logic is in provision/setup.sh. The provisioning script updates packages, installs build dependencies and openbsd-inetd, removes existing secure telnet packages, downloads and compiles GNU InetUtils 2.7 from source, verifies the tarball with GPG via keyserver.ubuntu.com, creates weak credentials (student/student123 and root/toor), weakens PAM by commenting out pam_securetty protections in /etc/pam.d/login, and registers /usr/local/libexec/telnetd with openbsd-inetd in /etc/inetd.conf so the service listens on TCP port 23. It also plants /root/flag.txt and a hint file for the student account. The exploit capability described by the repository is an unauthenticated network-based authentication bypass over Telnet. By running USER='-f root' telnet -a 192.168.56.10, the client sends a USER environment variable during Telnet negotiation; the vulnerable telnetd forwards this unsanitized value to /usr/bin/login, which interprets -f root as a pre-authenticated login request and grants a root shell. Because the repository primarily sets up a target rather than shipping a reusable exploit program, its maturity is best classified as POC.

This repository is a small standalone Python exploit/scanner project, not part of a larger framework. It contains one executable code file, `telnet_scan.py`, plus a README and license. The script is an interactive Telnet assessment tool targeting two claimed GNU InetUtils telnetd vulnerabilities: CVE-2026-24061 and CVE-2026-32746. Repository structure is simple: `telnet_scan.py` is the main and only code artifact; `README.md` documents installation, menu-driven usage, batch scanning, expected output, and mitigation guidance. The Python script uses standard library modules only (`socket`, `select`, `termios`, `tty`, `signal`, etc.), indicating a self-contained network tool. Core capabilities observed in the code and documentation: - Validates whether a target Telnet service is reachable before testing. - Supports single-target and file-based batch scanning. - Attempts CVE-2026-24061 by negotiating Telnet NEW_ENVIRON and sending a subnegotiation that sets `USER` to `-f root`. - Detects likely shell access by checking returned banner/output for shell-like prompts such as `#`, `$`, `>`, or `root@`. - If successful, drops the operator into an interactive shell over the existing socket using raw terminal mode. - Tests CVE-2026-32746 by negotiating LINEMODE and sending an oversized SLC-style payload intended to trigger a pre-authentication buffer overflow; success is inferred from connection drop/crash behavior rather than code execution. The exploit is best characterized as OPERATIONAL rather than a mere PoC because it includes working network logic, target validation, batch processing, and an interactive post-exploitation shell path for the auth-bypass case. However, it is not obviously weaponized or framework-integrated. Fingerprintable network/protocol indicators are limited because targets are user-supplied at runtime rather than hardcoded. The main identifiable target surface is TCP/23 (Telnet). Protocol-level indicators include Telnet option 39 (NEW_ENVIRON), option 34 (LINEMODE), and the injected string `USER=-f root`. The README also references `/usr/bin/login` as the downstream component affected by the environment injection. No hardcoded external C2, callback URLs, domains, or IP addresses are present in the code.

This repository is a small, focused exploit PoC for CVE-2026-24061, an authentication bypass in GNU InetUtils telnetd caused by unsafe use of the client-supplied USER value from Telnet NEW-ENVIRON negotiation. The repository contains only two files: a README describing the vulnerability, affected versions, exploitation logic, and patch history; and main.py, a standalone Python exploit client. The exploit works over the network against a Telnet service. It connects to a target host, defaults to TCP port 23, participates in Telnet option negotiation, accepts NEW-ENVIRON, and when the server requests environment variables, sends USER="-f root". According to the repository description, vulnerable telnetd passes this unsanitized value into login(1), effectively causing an invocation equivalent to '/usr/bin/login -p -h <host> -f root'. Because '-f' requests passwordless login for the named user, successful exploitation yields an unauthenticated interactive root shell. main.py is a minimal but functional exploit. Its structure includes: protocol constants for Telnet and NEW-ENVIRON; negotiate() to respond to Telnet DO/WILL/WONT handling; send_environ() to send the malicious USER variable; parse_stream() to separate Telnet IAC control sequences from application data and strip ANSI escapes; reader() to continuously receive and print server output; and main() to parse arguments, connect to the target, set the hardcoded payload '-f root', and provide an interactive session. The code is operational rather than a mere detector: it attempts exploitation directly and, on success, gives the operator a live shell. No external C2 or third-party infrastructure is used. The only network endpoint is the operator-supplied Telnet target. Fingerprintable artifacts include the default Telnet port 23, use of Telnet NEW-ENVIRON option 39, the USER environment variable, the hardcoded payload '-f root', and the vulnerable server-side binary path '/usr/bin/login' referenced in the documentation.

Repository contains a short Python exploit (telnetd.py) and a detailed README describing CVE-2026-24061, an unauthenticated remote authentication bypass in GNU Inetutils telnetd <= 2.7. Structure & purpose: - README.md: Explains the vulnerability mechanism (Telnet NEW-ENVIRON allows setting USER to "-f root"; telnetd forwards it unsanitized to /bin/login, which interprets '-f root' as pre-authenticated root), impact, affected versions, and remediation steps. - telnetd.py (~1 KB): Implements the exploit by opening a Telnet connection to a user-supplied host (default port 23), sending basic Telnet negotiation bytes, then sending a crafted NEW-ENVIRON subnegotiation payload that sets USER to "-f root". After a short delay, it drops into tn.interact() to provide an interactive session (intended to be a root shell). Exploit capabilities: - Remote, unauthenticated compromise of vulnerable telnetd via protocol-level environment injection. - Achieves authentication bypass/privilege escalation to root (interactive shell over the same Telnet session). - Minimal configuration: only requires network reachability to TCP/23 and a vulnerable inetutils telnetd configuration/behavior that forwards USER to login. Notable observables: - Network target is arbitrary <host> with default TCP port 23. - Protocol payload includes Telnet IAC SB NEW-ENVIRON ... IAC SE with USER value "-f root".

Repository contains a single Python proof-of-concept exploit and a README. - Files: - CVE-2026-24061.py: Async Python exploit using telnetlib3 to connect to a target telnetd service (default TCP/23). It sends a crafted Telnet ENVIRON subnegotiation that sets the USER environment variable to a malicious value of the form "-f<target_user>" (default "-froot"). The script then checks the server response; if it does not see a login/password prompt, it assumes the authentication bypass succeeded and drops into an interactive loop that lets the operator run arbitrary commands over the established telnet session. - README.md: Describes the vulnerability as an authentication bypass in GNU Inetutils telnetd versions 1.9.3–2.7, provides usage examples, and suggests mitigations. - Exploit capability: - Unauthenticated remote auth bypass via Telnet option negotiation (ENVIRON) to inject a crafted USER value intended to be interpreted as a login option, resulting in a remote shell as the specified user (root by default). - Notable implementation details: - Uses telnetlib3.open_connection with timeouts. - Constructs raw IAC/ENVIRON bytes and writes them as latin1-decoded text. - Provides an interactive pseudo-shell by sending user-entered commands and printing server output.

Repository contains a single Perl proof-of-concept exploit script for CVE-2026-24061 against telnetd, plus a minimal README, GPLv3 LICENSE, and a Perl-oriented .gitignore. Key file: `CVE-2026-24061.pl` (entry point). It: - Opens a TCP connection to a user-supplied target host and port (default 23). - Implements basic Telnet option negotiation stripping/handling (`negotiate`) and responds with WONT/DONT to most options. - Sends a crafted Telnet NEW-ENVIRON (option 39) subnegotiation payload that sets the variable name `USER` to the value `-f root` (suggesting argument/flag injection into telnetd’s handling of environment/user fields). - Forks into a reader process (prints server output to stdout after negotiation cleanup) and a writer loop (forwards stdin to the socket), effectively acting like a minimal interactive telnet client after delivering the payload. - Performs a simple vulnerability heuristic: if the reader child exits immediately after payload delivery, it prints that the target does not seem vulnerable. No additional modules, scanners, or multi-target automation are present; it is a single-target, interactive PoC focused on triggering the vulnerable code path via Telnet protocol messages rather than delivering a full post-exploitation payload (e.g., reverse shell).

Repository contains a single Python proof-of-concept exploit for CVE-2026-24061 plus README and MIT license. Structure & purpose: - README.md: Describes an alleged critical telnetd authentication bypass via improper handling of the USER environment variable, claims impact is RCE as root, and provides usage/mitigation/references. - cve-2026-24061-poc.py: Implements a minimal Telnet client that performs Telnet option negotiation and sends a crafted NEW-ENVIRON (option 39) subnegotiation setting USER to "-f root". It then starts a background reader thread to print server output and forwards stdin lines to the socket, effectively giving the operator an interactive session if the bypass succeeds. Exploit capabilities (from code): - Remote network exploitation over TCP against a Telnet service. - Sends a specific Telnet negotiation sequence and environment variable injection payload. - Provides an interactive post-exploitation channel (stdin->socket, socket->stdout) rather than dropping a separate reverse shell. - Includes a basic liveness/vulnerability heuristic: if the reader thread dies shortly after sending the payload, it reports the target likely not vulnerable. Notable implementation details: - negotiate() strips/handles Telnet IAC sequences and responds to DO/WILL with WONT/DONT for most options, while allowing option 39 (NEW-ENVIRON) to proceed. - Hardcoded payload bytes: b'\xff\xfb\x27\xff\xfa\x27\x00\x00USER\x01-f root\xff\xf0'. - Default port is positional optional argument with default 23. Overall, this is a small, single-file PoC intended to demonstrate an auth bypass in inetutils telnetd by abusing Telnet environment option handling, yielding an interactive session that is expected to run with elevated privileges if the target is vulnerable.

Repository purpose: a small Docker-based lab demonstrating a Telnet negotiation-based auto-login/username injection technique described as CVE-2026-24061, using the Telnet NEW-ENVIRON option (RFC1572). Structure (5 files): - exploit.py: Python Telnet client PoC. Connects to a user-supplied host on TCP/23, performs minimal Telnet option negotiation, and when the server requests NEW-ENVIRON it replies WILL NEW_ENVIRON and sends a subnegotiation that sets USERVAR "USER" to the local environment variable $USER. It then enters an interactive relay loop (socket <-> stdin/stdout). As a fallback, it detects "login:" or "username:" in server output and sends the username followed by CRLF. - compose.yaml: Defines two containers (node1 client, node2 server) on an isolated bridge network (labnet) with Docker DNS name resolution (e.g., target host "node2"). No host ports are exposed. - Dockerfile.node1: Builds a Python 3.12 slim client container, installs telnet, copies exploit.py, and idles (sleep infinity) for interactive use. - Dockerfile.node2: Builds a Python 3.12 slim server container, downloads and installs a specific inetutils-telnetd .deb from a Debian mirror, enables telnet in /etc/inetd.conf, and runs inetutils-inetd in debug mode. - readme.md: Walkthrough and explanation; shows example usage USER="-f root" python exploit.py node2, indicating the intended effect is to pass a crafted USER value via NEW-ENVIRON. Exploit capabilities: - Network-based interaction with Telnet servers. - Telnet option negotiation handling (DO/WILL) sufficient to respond to NEW-ENVIRON. - Sends a crafted NEW-ENVIRON payload to set USER, enabling username injection/auto-login behavior on vulnerable servers. - Provides an interactive session and a prompt-detection fallback that submits the username when a login prompt appears. Notable observables: - Hardcoded Telnet port 23. - Debian mirror URL used to fetch inetutils-telnetd package for the lab. - Service/hostnames: node1, node2; network: labnet; inetd/telnetd configuration paths and binaries.

Repository purpose: a Python 3.10+ Telnet scanner and exploitation framework for CVE-2026-24061 (Telnet NEW_ENVIRON USER variable injection leading to authentication bypass and potential root access). Core exploit capability: - Implements Telnet option negotiation and NEW_ENVIRON subnegotiation. - Exploit path (terminus/core/terminus_engine.py:TerminusNegotiator.exploit): sends a crafted NEW_ENVIRON IS VAR USER VALUE <payload> sequence (default payload "-f root"), then checks for absence of login/password prompts to infer auth bypass, and runs `id` to confirm root (uid=0/root). - Exploiter wrapper (terminus/core/exploit.py:TerminusExploiter) enforces safety controls: explicit authorization required and (by default) single-target-only exploitation; supports evidence collection and an interactive telnet shell mode. Scanning/detection: - High-concurrency async scanner (terminus/core/scanner.py) with rate limiting (TokenBucket), retries/backoff, and optional active verification. - Fingerprinting (terminus/detection/fingerprint.py) parses banners and can also infer daemon type from telnet option negotiation sequences. - Heuristics (terminus/detection/heuristics.py) provide non-destructive probing of NEW_ENVIRON support/USER var acceptance and risk scoring. - Signature DB (signatures.db + terminus/detection/signatures.py) encodes vulnerable version patterns and exploitation metadata for CVE-2026-24061. Reporting/CLI: - CLI entry point: `terminus` script -> terminus/cli.py:main; module entry: terminus/__main__.py. - Outputs: terminal tables (rich), JSON/CSV/HTML/Markdown reports using Jinja2 templates (terminus/reporting/*). - Helper scripts: terminus_helper.sh and terminus_helper.ps1 provide convenience wrappers and shell completion setup. Notable endpoints/targets: - Network target is generic: user-supplied hosts/IPs, default TCP port 23. - No hardcoded C2 or exfil endpoints observed; only reference URLs in signatures/license and local output paths (logs/reports/signatures.db). Overall structure: - terminus/core/: telnet protocol parsing/state machine, handshake/exploit negotiator, scanner, exploiter. - terminus/detection/: banner fingerprinting, heuristic probing, signature database loader. - terminus/reporting/: formatters, pydantic models, HTML/MD templates. - terminus/utils/: config loading (config.yaml), logging, target parsing (CIDR/ranges/DNS resolution). - tests/: extensive unit/integration tests covering exploit, protocol parsing, scanner behavior, reporting, and utilities.

Repository contains a single Python exploit script: cve-2026-24061.py (~17 KB). It implements a network-based exploit against GNU InetUtils telnetd (claimed affected versions 1.9.3–2.7) for CVE-2026-24061. Core technique: the script speaks raw Telnet protocol and performs option negotiation to use NEW_ENVIRON (0x27). It sets the USER environment variable to a value beginning with a dash (default payload: "-f root"). The script’s banner explains that GNU telnetd interpolates USER into a /bin/login command template using %U, allowing the attacker-controlled USER string to be treated as command-line arguments to /bin/login. With "-f root", /bin/login is coerced into a no-auth/forced login path, yielding a root session. Capabilities exposed via CLI: - Exploit and obtain an interactive shell over the telnet session (default behavior). - Execute a single command non-interactively (--cmd) and print output. - Check-only mode (--check) to determine if the target appears vulnerable without dropping into a shell. - Customization of target port (-p/--port) and injected USER payload (--user), plus verbose/debug output (-v). Notable observables/targets: - Network target is a telnet service on TCP port 23 by default. - Protocol fingerprint: Telnet NEW_ENVIRON negotiation and setting USER. - Server-side execution target: /bin/login (argument injection).

Repository contains a Python-based network exploit targeting GNU inetutils-telnetd, claiming CVE-2026-24061 (remote authentication bypass via telnet NEW_ENVIRON). Structure is minimal: main.py (exploit), README.md (usage/download marketing), pyproject.toml (packaging metadata), and .python-version. main.py implements a telnet client that performs option negotiation (IAC DO/WILL, subnegotiations for TTYPE=24, TSPEED=32, NEW_ENVIRON=39). When the server requests NEW_ENVIRON (SEND), it sends a crafted NEW_ENVIRON payload setting the USER variable to "-f <user>" (default "root"), intending to abuse telnetd/login behavior to bypass authentication and drop into an interactive session. The script supports single-target mode (-u) and a list mode (-l) that reads hosts from a file and runs exploitation attempts concurrently using threads; port is configurable with -p and username with -usr. Notable observations: the README heavily emphasizes downloading a prebuilt binary from GitHub Releases, while the actual exploit logic is in Python. The provided main.py content is truncated in the middle of Exploit.run(), but enough code is present to confirm the core capability: network-based telnet negotiation leading to sending the NEW_ENVIRON USER='-f <user>' payload and then handling interactive I/O.

Repository contains a Python proof-of-concept exploit for an alleged GNU inetutils-telnetd authentication bypass (CVE-2026-24061) plus a Dockerfile to stand up a test target. Structure: - cve_2026_24061_telnetd.py: Main exploit. Implements a minimal telnet client that performs option negotiation and, when the server requests NEW_ENVIRON (option 39), sends a crafted subnegotiation setting environment variable USER to "-f <user>" (default root). The script then relays data between the user (interactive TTY or piped stdin) and the telnet socket, effectively providing an interactive session/command execution channel if the bypass succeeds. - Dockerfile.vulnerable: Builds an Ubuntu 20.04 container with inetutils-telnetd and xinetd, enables telnet service on TCP/23, sets root password to "toor", and adjusts /etc/securetty to permit root logins on pseudo-terminals. Intended for local testing. - README.md: Describes the vulnerability concept (NEW_ENVIRON USER value interpreted as a login flag like "-f root"), provides usage examples (including piping commands), and points to a GitHub releases page. Notable exploit behavior: - Network-only attack against a telnet service; no scanning/detection logic. - Handles telnet negotiations for TTYPE (24), TSPEED (32), and NEW_ENVIRON (39) and responds with basic values (xterm, 38400,38400). - Payload is fixed to the NEW_ENVIRON injection; user can choose target host, port, and username, but there is no modular payload framework. Overall purpose: provide an operational PoC that attempts to bypass telnetd authentication and obtain a remote session as a chosen user (default root), with a containerized environment to reproduce/test the issue.

Repository contains a single Python exploit script and a README describing CVE-2026-24061 (GNU Inetutils telnetd auth bypass). The exploit is a network-based Telnet protocol abuse: it connects to a target telnetd (user supplies host/port, typically TCP/23), negotiates Telnet options NEW_ENVIRON (39) and ENVIRON (36), and injects an environment variable `USER` with the value `-f root`. This is intended to influence the server-side login invocation so that `/bin/login -f root` is executed, skipping password verification and yielding a root shell. Key code structure (CVE-2026-24061.py): - `TelnetNegotiator`: Implements minimal Telnet IAC parsing and option negotiation (DO/DONT/WILL/WONT, SB/SE). Tracks whether env payload was sent (`self.sent`) and whether server agreed to ECHO (`echo_ok`). - `send_env(opt)`: Crafts and sends subnegotiation `IAC SB <opt> ENV_IS ENV_VAR "USER" ENV_VALUE "-f root" IAC SE` (default user string is "-f root"). - `exploit(host, port)`: Connects via TCP, sends `WILL NEW_ENVIRON` and `WILL ENVIRON`, reads server responses, forces env injection if not requested, then sends a blank line to trigger login flow. It performs basic vulnerability checks: if output contains a login/password prompt (`has_login`) it assumes not vulnerable; it also requires seeing `WILL ECHO` as a heuristic. It then sends `id` and checks for `uid=` to confirm shell access. - `shell(conn, neg)`: Provides an interactive session, with a background thread parsing and printing server output while the user types commands. Overall purpose: provide an operational PoC that attempts unauthenticated remote root access on vulnerable GNU Inetutils telnetd instances by abusing Telnet environment option handling. No scanning, worming, or C2 behavior is present; the only network activity is the direct TCP connection to the specified target.

Repository contains a standalone Python Telnet scanner/exploit PoC for CVE-2026-24061 affecting GNU InetUtils telnetd. The core class (TelnetExploiter) opens a TCP connection to the target (default port 23), manually processes Telnet IAC negotiation, and when the server requests RFC1572 NEW-ENVIRON (DO NEW-ENVIRON followed by SB NEW-ENVIRON SEND), it replies with a crafted subnegotiation payload that sets the environment variable USER to "-f root" (IAC SB NEW-ENVIRON IS VAR USER VALUE -f root IAC SE). This is intended to trigger an unauthenticated root shell/auth bypass condition on vulnerable telnetd. A MassScanner wrapper expands targets from a single IP, CIDR ranges, or a file, and uses ThreadPoolExecutor for multithreaded scanning. Results are printed with colorized status (via colorama) and can be written to a CSV output file. Dependencies are minimal (colorama, netaddr). Overall structure: README with usage/disclaimer, requirements.txt, and a single main script entry point (cve_2026_24061_poc.py) implementing both exploitation logic and mass-scanning orchestration.

Repository purpose: a minimal Docker-based lab environment to demonstrate an authentication bypass in GNU inetutils telnetd (claimed CVE-2026-24061). It is not a full exploit toolkit; it provides a reproducible vulnerable service and a one-liner payload to obtain a root shell. Structure and key files: - Dockerfile: Builds a Debian 11 slim image, installs inetutils-telnetd (and telnet client), creates a non-root user (user1), and modifies /etc/inetd.conf to enable the telnet service. Copies in an entrypoint script. - docker-entrypoint.sh: Starts inetutils-inetd in debug mode in the background, prints instructions, then drops the interactive session to user1. - README.md: Documents the vulnerability mechanics and provides the exploit command: setting USER='-f root' and connecting via telnet (-a) to localhost. The described primitive is argument injection into /usr/bin/login, leveraging login's '-f' option to skip authentication. Exploit capability: - Remote (network) authentication bypass against telnetd leading to immediate root access, assuming the service is exposed and vulnerable. In this lab, the attack is demonstrated locally against localhost, but the same technique would apply to a reachable telnet service. Notable observables: - Service endpoint: telnet on port 23 (implicit), demonstrated as telnet to localhost. - Configuration touchpoints: /etc/inetd.conf enabling telnet; inetd binary /usr/sbin/inetutils-inetd; login binary /usr/bin/login as the injection sink.

Repository purpose: a Python-based scanner + exploitation toolchain for CVE-2026-24061 (Telnet NEW_ENVIRON USER-variable injection leading to authentication bypass and potential root access). Core exploit capabilities: - Network-based Telnet handshake and option negotiation parsing (IAC/DO/WILL/SB/SE) to detect NEW_ENVIRON (option 39) support. - Passive detection: banner grabbing + daemon/version fingerprinting (netkit-telnetd, BSD telnetd, inetutils telnetd, generic) and matching against a local signature DB (signatures.db). - Heuristic probing (optional): sends a non-destructive NEW_ENVIRON SEND/VAR probe to see if USER is accepted; computes risk score and a numeric vulnerability score. - Active verification mode: attempts the actual CVE primitive and confirms impact by sending `id` and checking for uid=0/root. - Exploitation mode: sends a crafted NEW_ENVIRON subnegotiation setting USER to an attacker-controlled value (default "-f root"), optionally collects evidence (initial output, id output, banner, payload) and can provide an interactive session. Notable safety controls: - Exploitation requires explicit authorization (ExploitConfig.authorized / CLI confirmation). - Default restriction to single-target exploitation (blocks batch exploitation unless configured otherwise). Network/targeting details: - Primary target is TCP port 23 (configurable). The exploit is protocol-specific to Telnet RFC 854/1572 negotiation and NEW_ENVIRON. - No hardcoded victim IPs/domains; targets are user-supplied via CLI, file, CIDR, or IP range. Hostnames can be resolved via DNS (aiodns). Repository structure: - terminus/cli.py: Click-based CLI entry point (scan/verify/exploit/report output). Uses rich for progress/UI. - terminus/core/protocol.py: Telnet state machine and session abstraction; parses IAC sequences and subnegotiations. - terminus/core/terminus_engine.py: Handshake logic and the actual exploit primitive (builds NEW_ENVIRON IS VAR USER VALUE <payload>), plus post-exploit command sending. - terminus/core/scanner.py: Async high-concurrency scanner with rate limiting (token bucket), retries, optional probing and verification. - terminus/detection/*: BannerAnalyzer (fingerprinting), heuristics (risk scoring, probe), signatures (loads signatures.db). - terminus/reporting/* + templates: terminal/JSON/CSV/HTML/Markdown reporting. - terminus/utils/*: config loading (config.yaml), logging (JSON/colored, rotating file), network target parsing (CIDR/range/hostname resolution). - tests/: extensive pytest suite including mocked telnet sessions and CLI tests. Overall: this is an operational, end-to-end network scanner with an integrated proof-of-exploit and interactive exploitation path for CVE-2026-24061, rather than a single minimal PoC.