Telly

Scenario

This Sherlock provides players with an opportunity to analyze network traffic and find evidence of exploitation of CVE-2026-24061 against the telnet protocol, allowing root remote access without any credentials and prior access.

Executive Summary

An attacker on the internal network exploited a Telnet authentication bypass against a backup server and landed in a root shell without ever supplying a password. From that shell they created a local backdoor account, pulled a public Linux persistence toolkit from GitHub with wget, and ran it pointed at an external C2 address. About ten minutes after the initial exploit, they served a database of customer payment data off the host over plain HTTP on a high port. The whole intrusion is readable from one packet capture, because Telnet and HTTP both send everything in cleartext.

Artifacts

• Packet capture: monitoringservice_export_202610AM-11AM.pcapng → tshark (or Wireshark). Telnet session on port 23 and HTTP-style traffic on port 6932

Timestamp note: Frame times in the capture carry a +11:00 offset, but the answers are in UTC. Subtract 11 hours from every frame time. The Telnet banner prints its own UTC clock, which confirms the conversion.

Initial Access

The scenario names it. CVE-2026-24061 is an authentication bypass in telnetd: the client sends a USER environment variable of -f root during option negotiation, and the server hands it to login, which reads -f as “already authenticated”. The capture confirms the pattern in Q2.

Start with conversations and protocol hierarchy to find the busy hosts. One Telnet session stands out: 192.168.72.131 to 192.168.72.136:23. Dump the Telnet negotiation in verbose mode and find the NEW-ENVIRON option carrying USER set to -f root. The next thing in the stream is a shell prompt, and id returns root. That frame is stamped 21:39:28 +11:00, which is 10:39:28 UTC, and the server banner agrees.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -q -z conv,tcp

tshark -r monitoringservice_export_202610AM-11AM.pcapng -Y 'telnet' -V

Gotcha: The pcap’s local time is +11:00. Submitting the frame time as shown is eleven hours off.

The shell prompt that appears straight after the bypass names the host. Pull the Telnet data fields and read the first prompt after login.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -Y 'telnet.data' -T fields -e frame.number -e telnet.data

Persistence

Telnet is cleartext, so following the stream shows the attacker’s input as typed. They pasted a useradd for a new account, then piped user:password into chpasswd. Both the username and the password sit in that one line.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -q -z follow,tcp,ascii,0

Command and Control

Same stream, a few lines later. The attacker typed a wget for linper.sh from the montysecurity/linper GitHub repository, a public Linux persistence toolkit. The format hint in the task matches the raw URL form, so take the command exactly as typed, including the refs/heads/main path.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -Y 'telnet.data' -T fields -e telnet.data | grep -i wget

From Q5 the script is linper.sh. The attacker ran it with a pasted IP address and -p 59, which is the callback host and port the script was configured with. The IP is in the keystrokes right after the script runs. The pcap shows the invocation, not which persistence mechanisms linper then installed.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -Y 'telnet.data' -T fields -e telnet.data | grep -i linper

Exfiltration

Back in the packet list, filter HTTP on the odd port seen during triage. An HTTP GET /credit-cards-25-blackfriday.db goes to port 6932 in frame 9373, and the response carries the file. Frame time 21:49:54 +11:00 converts to 10:49:54 UTC.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -Y 'http.request and tcp.port==6932' -T fields -e frame.number -e frame.time -e http.request.uri

Follow the TCP stream for the download (stream 727) in raw mode and write it out. The raw stream still contains the HTTP response headers, so carve the file by searching for the SQLite format 3 magic bytes and writing from that offset. Open the result with sqlite3; the schema has a purchases table, and filtering on the customer email [email protected] returns the card number.

tshark -r monitoringservice_export_202610AM-11AM.pcapng -q -z follow,tcp,raw,727

d = open('raw.bin','rb').read(); open('c.db','wb').write(d[d.index(b'SQLite format 3'):])

SELECT * FROM purchases WHERE email = '[email protected]';

Tip: tshark --export-objects http,<dir> also extracts the HTTP objects, but carving from the followed stream is the route that produced a working database here.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Telnet should not be running at all. A cleartext remote shell gave the attacker root and also gave us every keystroke, password included. Replace it with SSH, and where telnetd must exist, patch it and keep it off reachable networks.

The bypass has a clean network signature. A NEW-ENVIRON option with -f in the USER value is not something a legitimate client sends. An IDS rule on that pattern catches exploitation at the first packet.

Account creation from an interactive session on a backup host is rare. useradd followed by chpasswd minutes after a Telnet login should alert, and so should a download of known persistence tooling like linper.sh from raw.githubusercontent.com on a server.

A database leaving over a high port in the clear is an egress failure. A .db file served over HTTP on port 6932 should stand out in flow monitoring. The card numbers were also stored unencrypted in a plain SQLite file, which turned one compromised host into a full data breach.

Conclusion

One option in a Telnet handshake gave the attacker root with no credentials, and ten minutes later a customer card database left the network over plain HTTP. Everything, including the backdoor password, was readable in the capture, so the real gap was a cleartext service that never should have been exposed.