Privilege Escalation in GNU inetutils telnetd via CREDENTIALS_DIRECTORY

Repository contains a small Python proof-of-concept for CVE-2026-28372 targeting GNU inetutils telnetd (<= 2.7). Structure: (1) README.md describing the vulnerability (environment variables passed from telnetd to login(1)), the intended exploit chain (use Telnet NEW-ENVIRON to inject CREDENTIALS_DIRECTORY and provide a login.noauth file), and basic usage; (2) exploit.py implementing an automated trigger; (3) MIT license. Exploit behavior (exploit.py): it creates a temporary directory (prefix 'telnet_poc_'), writes a file named 'login.noauth' with content 'yes', sets the process environment variable CREDENTIALS_DIRECTORY to that directory, and launches the local 'telnet' client to the specified host (default 127.0.0.1) using subprocess.run(["telnet","-E","-K","-L",target], env=env). It then cleans up the temporary directory. Notable issues/limitations: the script does not actually implement Telnet NEW-ENVIRON option negotiation itself; it relies on the external telnet client and only sets the local process environment. Whether this environment is transmitted to telnetd depends on telnet client behavior and server negotiation; as written, it may not reliably perform the described environment injection. Additionally, the entry-point guard is buggy: it uses `if name == "__main__":` instead of `if __name__ == "__main__":`, so the script will raise a NameError and not run unless corrected. Overall maturity is best classified as a PoC rather than an operational exploit.

Repository contains a single Python PoC (exploit.py) plus README and MIT license. The README claims CVE-2026-28372 in GNU inetutils telnetd <= 2.7: telnetd allegedly forwards client-controlled environment variables (via Telnet NEW-ENVIRON) to login(1). By setting CREDENTIALS_DIRECTORY to an attacker-controlled directory containing login.noauth='yes', authentication can be bypassed, yielding a privileged session. Code behavior: exploit.py creates a temporary directory (prefix telnet_poc_), writes a login.noauth file with 'yes', sets the local process environment variable CREDENTIALS_DIRECTORY to that directory, and launches the system telnet client to connect to the target (default 127.0.0.1) using subprocess.run(["telnet","-E","-K","-L",target], env=env). It then cleans up the temp directory. Notable issues/limitations: the script does not implement Telnet NEW-ENVIRON negotiation itself; it only sets an environment variable for the local telnet client process. Whether that environment variable is actually transmitted to telnetd depends on the telnet client’s behavior and options (and may not occur as written). Additionally, the script has a bug in the entry-point guard: it uses `if name == "__main__":` instead of `if __name__ == "__main__":`, so it will not run when executed unless corrected. Overall, this is a basic PoC intended to demonstrate the exploit chain rather than a robust, weaponized exploit.

Repository contains a Python 3 proof-of-concept exploit for CVE-2026-28372 targeting GNU inetutils telnetd (<= 2.7) on Linux when paired with util-linux login(1) versions that support the login.noauth mechanism. The exploit is a local privilege escalation/authentication bypass chain: it creates an attacker-controlled credentials directory under the current user’s home (~/fake_creds_cve_2026_28372) and writes a login.noauth file containing 'yes'. It then connects to a telnetd service (default 127.0.0.1:23) using telnetlib and sends raw Telnet IAC negotiation bytes to use option 36 (NEW-ENVIRON) to inject environment variables USER (default root) and CREDENTIALS_DIRECTORY (pointing to the attacker directory). If telnetd passes these variables to login(1) and login honors login.noauth from that directory, authentication can be bypassed and the script drops into an interactive telnet session (tn.interact()), potentially yielding a root shell. Repo structure is minimal: one main exploit script (entry point) and a README documenting affected versions, prerequisites, usage flags (--host/--port/--user), and mitigations (sanitizing/unsetting CREDENTIALS_DIRECTORY, disabling telnet).

Repository contains a Python 3 proof-of-concept exploit for CVE-2026-28372 targeting GNU inetutils telnetd (<= 2.7) on Linux when paired with util-linux login(1) versions that support the login.noauth mechanism. Structure: (1) `GNU inetutils telnetd Privilege Escalation.py` is the sole exploit script and entry point; (2) `README.md` documents the vulnerability, prerequisites, and usage. Core capability: local privilege escalation to root by abusing telnet protocol option NEW-ENVIRON (option 36) to inject environment variables that telnetd passes to login(1). The script creates an attacker-controlled directory under the user’s home (`~/fake_creds_cve_2026_28372`) and writes `login.noauth` containing `yes`. It then connects to a telnetd endpoint (default 127.0.0.1:23), sends crafted IAC negotiation bytes and a NEW-ENVIRON subnegotiation that sets `USER` (default `root`) and `CREDENTIALS_DIRECTORY` to the attacker directory. If the target’s login(1) honors `CREDENTIALS_DIRECTORY` and reads `login.noauth=yes`, authentication can be bypassed and the script drops into an interactive telnet session (`tn.interact()`), intended to provide a root shell. Notable observables: network connection to configurable host/port (defaults localhost:23), creation of the credentials directory and `login.noauth` file in the invoking user’s home directory, and explicit injection of `USER` and `CREDENTIALS_DIRECTORY` via telnet NEW-ENVIRON.