Out-of-bounds write in GNU Inetutils telnetd LINEMODE SLC handler

This repository is a small exploit toolkit targeting GNU InetUtils telnetd with two pre-authentication issues: CVE-2026-24061 and CVE-2026-32746. It contains 10 files total, primarily Python plus one Bash scanner wrapper. The main structure is: two primary exploit implementations in exploits/exploit_cve_2026_24061.py and exploits/exploit_cve_2026_32746.py; three focused PoC/support scripts for CVE-2026-32746 (exploit_heap_ptr.py, exploit_rce.py, exploit_slctab_crash.py); a bulk scanner in exploits/scanner.py; and a shell-based parallel scanner in scan_telnetd.sh. CVE-2026-24061 exploit: a network Telnet exploit against TCP/23 that abuses Telnet NEW-ENVIRON negotiation. The code negotiates Telnet options, responds to NEW-ENVIRON requests, and injects USER="-f root" (or a custom string) so telnetd passes it into /usr/bin/login as a command-line argument. The intended result is authentication bypass and an immediate pre-auth root shell. The script supports at least check mode and interactive shell mode, making it more than a detector. CVE-2026-32746 exploit: a more advanced Telnet LINEMODE/SLC overflow exploit framework. It crafts malicious SLC triplets in Telnet subnegotiation to overflow slcbuf and corrupt adjacent BSS state. Repository descriptions indicate multiple capabilities: crash verification, probing, pointer corruption, arbitrary-write style primitives, and target-specific RCE by overwriting GOT/function pointers. The main exploit file exposes multiple modes such as crash, probe, rce, and verify-rce, and requires target-specific offsets or profiles for reliable code execution. This makes it operational but not fully weaponized. The auxiliary CVE-2026-32746 scripts document and demonstrate exploitation stages: exploit_slctab_crash.py aims for controlled SIGSEGV via slctab corruption; exploit_heap_ptr.py demonstrates corruption of I/O buffer pointers to redirect writes; exploit_rce.py chains several primitives and explicitly assumes a fixed target layout (GNU inetutils telnetd 2.5, ASLR disabled, known binary/libc bases). These files are useful for exploit development and validation rather than generic one-click exploitation. The scanner.py script performs bulk scanning of targets from a file or stdin, checks TCP connectivity, invokes the exploit classes directly, and records whether CVE-2026-24061 yields RCE and whether CVE-2026-32746 appears vulnerable/crashable or RCE-capable. The Bash script scan_telnetd.sh wraps the two main Python exploits for parallelized scanning and CSV output. Overall, the repository’s purpose is offensive security research and validation of pre-auth Telnet daemon vulnerabilities, with both exploitation and scanning workflows centered on GNU inetutils telnetd over TCP port 23.

This repository is a small standalone Python exploit/scanner project, not part of a larger framework. It contains one executable code file, `telnet_scan.py`, plus a README and license. The script is an interactive Telnet assessment tool targeting two claimed GNU InetUtils telnetd vulnerabilities: CVE-2026-24061 and CVE-2026-32746. Repository structure is simple: `telnet_scan.py` is the main and only code artifact; `README.md` documents installation, menu-driven usage, batch scanning, expected output, and mitigation guidance. The Python script uses standard library modules only (`socket`, `select`, `termios`, `tty`, `signal`, etc.), indicating a self-contained network tool. Core capabilities observed in the code and documentation: - Validates whether a target Telnet service is reachable before testing. - Supports single-target and file-based batch scanning. - Attempts CVE-2026-24061 by negotiating Telnet NEW_ENVIRON and sending a subnegotiation that sets `USER` to `-f root`. - Detects likely shell access by checking returned banner/output for shell-like prompts such as `#`, `$`, `>`, or `root@`. - If successful, drops the operator into an interactive shell over the existing socket using raw terminal mode. - Tests CVE-2026-32746 by negotiating LINEMODE and sending an oversized SLC-style payload intended to trigger a pre-authentication buffer overflow; success is inferred from connection drop/crash behavior rather than code execution. The exploit is best characterized as OPERATIONAL rather than a mere PoC because it includes working network logic, target validation, batch processing, and an interactive post-exploitation shell path for the auth-bypass case. However, it is not obviously weaponized or framework-integrated. Fingerprintable network/protocol indicators are limited because targets are user-supplied at runtime rather than hardcoded. The main identifiable target surface is TCP/23 (Telnet). Protocol-level indicators include Telnet option 39 (NEW_ENVIRON), option 34 (LINEMODE), and the injected string `USER=-f root`. The README also references `/usr/bin/login` as the downstream component affected by the environment injection. No hardcoded external C2, callback URLs, domains, or IP addresses are present in the code.

This repository is a standalone Python exploit research repo for CVE-2026-32746, a pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC handling. It is not part of a larger exploit framework. The repo contains one safe detector, multiple exploit/research scripts, a Dockerized lab, and extensive writeups documenting exploitability limits. Structure and purpose: - detect.py: non-destructive network detector. It connects to a telnet service, performs option negotiation, offers WILL LINEMODE, sends TTYPE/TSPEED suboptions, and checks whether the server accepts LINEMODE and begins SLC negotiation. This is effectively a vulnerability detection/fingerprinting script. - exploit.py: main PoC DoS exploit. It negotiates telnet options, enters LINEMODE, then sends a crafted SLC suboption with many triplets (default 60) to overflow the fixed SLC response buffer and crash or hang telnetd. This is the clearest operational exploit in the repo. - exploit_leak.py: info-leak exploit. It performs fuller telnet negotiation, waits for the server SLC suboption, sends an overflow payload, and parses the oversized SLC response to recover the slcptr value from offset 112, then derives the PIE base. This demonstrates reliable pre-auth memory disclosure. - exploit_aslroff.py: staged research exploit for ASLR-off/known-base conditions. It combines PIE leak, controlled BSS write positioning, and deferred free/corruption experiments to show post-overflow effects, but not working RCE. - exploit_bruteforce.py: analysis script testing whether partial pointer overwrite/brute force is viable. It concludes GCC register optimization prevents arbitrary slcptr control and that brute force is unnecessary because the info leak is reliable. - exploit_file_struct.py: the most detailed RCE feasibility analysis. It maps BSS targets and evaluates multiple candidate control-flow hijack paths (decrypt_input overwrite, authenticated pointer redirection, glibc hooks, FSOP, etc.), concluding RCE is blocked on Debian 12 / glibc 2.36 / Full RELRO / PIE / NX. - exploit_rce_attempt.py: earlier precision-write attempt script. Based on the repository findings, some of its assumptions about arbitrary slcptr control appear superseded by later corrected analysis. - Dockerfile, docker-compose.yml, xinetd-telnet.conf: self-contained vulnerable lab using Debian bookworm, inetutils-telnetd under xinetd, exposed on host port 2323. - FINDINGS.md and SUMMARY_EN.md: extensive technical analysis documenting the bug, BSS layout, leak primitive, constrained 2-byte write primitive, and why modern hardened targets do not reach RCE. Main exploit capabilities extracted from the code and documentation: 1. Pre-auth remote detection/fingerprinting of likely vulnerable GNU InetUtils telnetd via LINEMODE/SLC negotiation. 2. Pre-auth remote denial of service by overflowing the SLC buffer and causing telnetd to crash or stop responding. 3. Pre-auth remote information disclosure: oversized SLC response leaks BSS contents including a PIE-relative pointer, allowing calculation of the binary base. 4. Constrained memory corruption/write primitive: end_slc() writes fixed bytes 0xFF 0xF0 at a BSS offset determined by triplet count/alignment, with additional corruption of adjacent BSS variables such as slcchange, def_slclen, and def_slcbuf. 5. Research-only exploration of secondary effects such as invalid free() and function-pointer corruption, but no demonstrated working shell or arbitrary code execution on the documented modern target. Network behavior and targets: All active scripts are network-based and target a telnet service over TCP, defaulting to port 23 unless overridden. The lab maps host TCP/2323 to container TCP/23. The scripts implement telnet option negotiation using IAC/DO/WILL/WONT/DONT/SB/SE and specifically interact with LINEMODE (0x22), TTYPE (0x18), TSPEED (0x20), and in some scripts NAWS (0x1F). The exploit payload is a malicious LINEMODE SLC suboption (LM_SLC = 0x03) containing many SLC triplets with function codes greater than NSLC (18). Overall assessment: This is a real exploit repository with working network PoCs and a lab environment. The most credible demonstrated outcomes are detection, reliable pre-auth DoS, and reliable pre-auth PIE/base leakage. The repository's own later analysis strongly indicates that full RCE is not achieved on modern hardened Debian bookworm targets, making the repo operational for crash/leak exploitation but primarily research-oriented for deeper code-execution attempts.

This repository is a standalone Python proof-of-concept for CVE-2026-32746, a pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC handler. It is not part of a larger exploit framework. The repository contains 8 files: two Python scripts (exploit and detector), a Docker-based lab environment, service configuration, and documentation. The main exploit is exploit.py. It connects to a Telnet server over TCP, performs initial Telnet option negotiation, proactively offers WILL LINEMODE, sends TTYPE and TSPEED suboptions to satisfy expected negotiation flow, and then transmits a malicious LINEMODE SLC suboption. The payload is built in build_slc_payload() and consists of repeated 3-byte SLC triplets whose function codes exceed NSLC=18. According to the code and README, this causes telnetd's add_slc() logic to queue repeated 'not supported' responses into a fixed buffer of about 104 usable bytes, overflowing it after roughly 35 triplets. The default exploit sends 60 triplets, aiming to corrupt the slcptr pointer and trigger a crash when end_slc() writes through the corrupted pointer. The script then checks for timeout, reset, or broken pipe to infer service crash. This is a pre-auth network attack vector against Telnet. The repository also includes detect.py, a non-destructive detection script. It performs similar Telnet negotiation but stops after checking whether the server accepts LINEMODE and begins SLC negotiation. It does not send the overflow payload and is intended for safer identification of likely vulnerable GNU InetUtils telnetd instances. The Dockerfile, docker-compose.yml, and xinetd-telnet.conf create a local lab environment using Debian bookworm-slim with inetutils-telnetd and xinetd. The container exposes Telnet on port 23 and docker-compose maps it to host port 2323. A test user is created for login verification, though the exploit itself is explicitly pre-authentication and does not require credentials. Overall, the repository's purpose is to demonstrate and validate the vulnerability by crashing the target service, not to provide full remote code execution. The README explicitly states that code execution is not implemented and outlines only high-level future steps for developing an RCE chain. As such, the exploit is best classified as an operational DoS/crash PoC with a basic, hardcoded protocol payload and a companion detection utility.