Gonçalo RibeiroJan 26

Here I am installing #telnetd on Debian in the laboratory... To test CVE-2026-24061.

#CVE_2026_24061

Show threadGonçalo RibeiroJan 26
vagrant init debian/bookworm64
vagrant up
vagrant ssh

sudo bash
apt update
apt install inetutils-telnetd=2:2.4-2+deb12u1 inetutils-telnet=2:2.4-2+deb12u1
  • Edit /etc/inetd.conf to enable telnetd
  • systemctl restart inetutils-inetd
  • Check telnet is running (ss -tupln | grep :23)

    • Congratulations, you got yourself a system vulnerable to CVE-2026-24061 !

    #CVE_2026_24061 #telnetd #vulnerability

    Show threadGonçalo RibeiroJan 26

    Exploitation is completely trivial...

    #CVE_2026_24061 #telnetd #vulnerability

    Show threadGonçalo RibeiroJan 26

    Any good, legitimate checker around for CVE-2026-24061 ?

    Exploitation is trivial, checking for the vulnerability, not so much.

    #CVE_2026_24061 #telnetd #vulnerability

    Show threadGonçalo RibeiroJan 26

    I've successfully tested the PoC in the #SafeBreach Labs GitHub repository. It seems like a good place to start to write a checker (if there isn't a good one).

    https://github.com/SafeBreach-Labs/CVE-2026-24061

    #CVE_2026_24061 #telnetd #vulnerability

    GitHub - SafeBreach-Labs/CVE-2026-24061: Exploitation of CVE-2026-24061

    Exploitation of CVE-2026-24061. Contribute to SafeBreach-Labs/CVE-2026-24061 development by creating an account on GitHub.

    GitHub
    Show threadGonçalo Ribeiro
    Unfortunately the PoC code cannot determine if the exploit ran successfully or not. If it doesn't, you just get a normal login shell. I wonder if Telnet even has a way to tell if the login was successful...
    Jan 26 at 6:23pmWeb
    Show threadGonçalo RibeiroJan 26

    Looking at how nmap does it... I guess the protocol doesn't include something in that regard 😅 expected from an old protocol.

    I conclude this because the telnet-brute.nse script just checks for a set of common strings to determine if the login was successful or not.

    #telnet #nmap

    Show threadGonçalo RibeiroJan 26
    Well... I dusted off my #Linux #expect knowledge and created something very basic to at least get some results I can analyse later.