GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-24061, an authentication bypass in GNU Inetutils telnetd. It sends a crafted Telnet sub-negotiation containing the USER environment variable set to '-f root', which is passed unsanitized to /usr/bin/login, resulting in a root shell without authentication.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented authentication bypass exploit for CVE-2026-24061. It constructs Telnet sub-negotiation options to inject '-f root' as the USER environment variable, which is the described vulnerability mechanism. The module sends a standard Metasploit payload at the end of the negotiation, consistent with normal exploit behavior. No concealed executable behavior, unrelated remote access, persistence, credential theft, or deceptive payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively sends crafted Telnet data to bypass authentication and execute a payload on the target. It includes the full exploit logic, not just detection or scanning.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:6modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:125-139modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:147-148Requirements
- Target must be running a vulnerable version of GNU Inetutils telnetd (up to 2.7).
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:27-28 - Attacker must be able to establish a TCP connection to the Telnet service (default port 23).
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:64
Observed behavior
- Connects to the target Telnet service and performs a standard Telnet option negotiation sequence.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:82-123 - Sends a Telnet sub-negotiation (SB) for NEW_ENVIRON with the USER variable set to '-f root' to trigger the authentication bypass.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:125-139 - After the bypass, sends a payload (e.g., a command shell) to be executed on the target.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:147-148
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Telnet NEW_ENVIRON sub-option with USER variable set to '-f root'This is the documented authentication bypass technique for CVE-2026-24061, matching the CVE description and module metadata.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:131-135 - Payload Delivery
- payload.encoded sent after authentication bypassStandard Metasploit exploit behavior: after bypassing authentication, the module sends the configured payload to obtain a session.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:146-148
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full execution context is not available.
- Review is limited to the module source code and metadata. Framework mixins (e.g., Msf::Exploit::Remote::Telnet, Msf::Exploit::Capture) and the final payload.encoded content are not expanded or inspected.
- Binary files were not present in the evidence; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were included.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.