# Forgotten but Not Gone This repository contains proof-of-concept scripts for the vulnerabilities presented at the talk "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services" from Black Hat USA 2026 and DEF CON 34. ## CVE-2026-28372 Local privilege escalation in TelnetD: Unprivileged attackers can exploit TelnetD’s environment variables feature to grant them a root-privileged shell. By design and according to its RFC, the Telnet protocol enables its clients to set environment variables for the shell session. This feature was poorly designed from a security perspective. The service allowed unauthenticated clients to set environment variables for the telnetd process itself and for all its sub processes. One of its sub processes is /usr/bin/login. Setting environment variables as a remote telnet client enabled us to spawn /usr/bin/login with the environment variable “CREDENTIALS_DIRECTORY”. This causes the login process to search for a file named “login.noauth” in the directory specified by “CREDENTIALS_DIRECTORY”. If the file contains the string “yes”, the login process skips the authentication and provides a shell for the client running as the user the client specified. It can be any user, even root. ## CVE-2026-4408 Unauthenticated Remote Code Execution in Samba via SAMR: Samba relies on shell commands set in its configuration file (smb.conf) to carry out various operations requested by its clients, such as add a new network share, add a new printer, and more. Some of those shell commands receive parameters based on the request sent by the client. Most of the times, the parameters are sanitized and special characters are escaped before executing the command to prevent shell injection. The vulnerability resides in the function “check_password_complexity" that formats a string specified by the client into a shell command without sanitizing it. The vulnerability requires two conditions:
  1. "check password script" is configured the execute a command with the "%u" parameter
  2. the service is configured to use the NCACN_IP_TCP protocol sequence to accept RPC requests over TCP
When the call reaches the function "check_password_complexity”, the "UserAccountName" field from the "SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG" structure will be used as the username formatted into the parameter “%u” of the "check password script" command. The full command line is then passed to the function "smbrunsecret" which executes it without calling "escape_shell_string”. To configure the RPC daemon of samba (samba-dcerpcd) to use NCACN_IP_TCP, it needs to be launched as separate system service and not as part from the main samba service. Also, the option "rpc start on demand helpers” in the configuration file needs to be set to “no”. ## CVE-2026-4480 Unauthenticated Remote Code Execution in Samba via SPOOLSS: the function generic_job_submit also formats a client controlled string into a shell command without sanitizing it. The combination of the following configurations results in this vulnerability:
  1. The server exposes a printer share
  2. The "printing" configuration is set to any value other than IPRINT or CUPS
  3. The "print command" configuration contains "%J" to format the job name
An unauthenticated client can request access to a printer share via the spoolss RPC interface. Then, a print job can be submitted via the function RpcStartDocPrinter. The document name specified in the request will be used as the job name formatted into the “%J” parameter of the command. Calling hRpcEndDocPrinter triggers generic_job_submit which will execute the “print command” from the configuration after formatting the job name without sanitization. The code sent by the exploit will be executed as the user "nobody". If the configuration "valid users = @users" is added to the printer share section, the exploitation still works, but requires valid credentials. If authentication was performed, code sent by the exploit will be executed as the authenticated user and not as "nobody". ## Credits * [Ron Ben Yizhak](https://x.com/RonB_Y) ## References * [CVE-2026-24061](https://github.com/SafeBreach-Labs/CVE-2026-24061)