> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/telnet.md).

# Telnet

**Telnet** is an old network protocol used for remote command-line access. It transmits all data, including credentials, in cleartext, making it insecure by design. However, it is still found on legacy systems and embedded devices.

***

### Default Telnet Ports

| Port | Description                                   |
| ---- | --------------------------------------------- |
| 23   | Default Telnet port                           |
| 2323 | Alternate Telnet port (common on IoT devices) |

***

### Banner Grabbing and Manual Testing

Use `telnet` or `nc` to connect and grab the banner or interact with the login prompt:

```bash
telnet <ip> 23
```

or

```bash
nc -vn <ip> 23
```

Look for:

* OS and service banners
* Login prompts (username/password or device-specific authentication)
* Clues about the underlying system (e.g., Cisco, embedded Linux, etc.)

***

### Nmap Scripts for Telnet Enumeration

Nmap provides a few NSE scripts for enumerating and exploiting Telnet services:

```bash
nmap -p 23 --script=telnet-encryption,telnet-ntlm-info,telnet-brute <ip>
```

| Script              | Description                                                    |
| ------------------- | -------------------------------------------------------------- |
| `telnet-encryption` | Detects support for Telnet encryption                          |
| `telnet-ntlm-info`  | Extracts NTLM info if the Telnet server supports it            |
| `telnet-brute`      | Attempts brute-force authentication using provided credentials |

***

### Brute-Force Telnet Credentials

Use tools like **Hydra** or **Medusa** to perform online password attacks:

#### Hydra

```bash
hydra -L users.txt -P passwords.txt <ip> telnet
```

#### Medusa

```bash
medusa -h <ip> -U users.txt -P passwords.txt -M telnet
```