hacktricks/network-services-pentesting/pentesting-telnet.md

# 23 - Telnet渗透测试

<details>

<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* 你在一家**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)或**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**

</details>

<figure><img src="../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>

[**DragonJAR Security Conference是一场国际网络安全活动**](https://www.dragonjarcon.org/)，已经举办了十多年，将于2023年9月7日至8日在哥伦比亚波哥大举行。这是一个内容丰富的技术活动，展示了吸引全球黑客和研究人员的最新研究成果。\
立即在以下链接注册，不要错过这个重要的会议！:

{% embed url="https://www.dragonjarcon.org/" %}

## **基本信息**

Telnet是一种网络协议，为用户提供了一种不安全的方式通过网络访问计算机。

**默认端口：**23
```
23/tcp open  telnet
```
### **枚举**

#### **获取横幅信息**
```bash
nc -vn <IP> 23
```
所有有趣的枚举都可以通过**nmap**进行执行：
```bash
nmap -n -sV -Pn --script "*telnet* and safe" -p 23 <IP>
```
脚本 `telnet-ntlm-info.nse` 将获取 NTLM 信息（适用于 Windows 版本）。

在 TELNET 协议中，有各种 "**选项**"，可以通过 "**DO, DON'T, WILL, WON'T**" 结构进行制定，并可用于允许用户和服务器同意使用更复杂（或者可能只是不同）的约定集来进行 TELNET 连接。这些选项可能包括更改字符集、回显模式等（来自 [telnet RFC](https://tools.ietf.org/html/rfc854)）\
**我知道可以枚举这些选项，但我不知道如何操作，所以如果你知道，请告诉我。**

### [暴力破解](../generic-methodologies-and-resources/brute-force.md#telnet)

## 配置文件
```bash
/etc/inetd.conf
/etc/xinetd.d/telnet
/etc/xinetd.d/stelnet
```
## HackTricks 自动命令

### Telnet

Telnet is a network protocol used to establish a remote shell session with a host over the Internet. It is commonly used for remote administration and debugging purposes. However, Telnet is considered insecure because it transmits data in plain text, making it vulnerable to eavesdropping and interception.

To automate Telnet commands, you can use the following syntax:

```bash
echo -e "command1\ncommand2\ncommand3" | telnet <host> <port>
```

Replace `<host>` with the target host IP address or domain name, and `<port>` with the target port number.

For example, to automate Telnet commands to a host with IP address `192.168.1.100` on port `23`, you can use the following command:

```bash
echo -e "command1\ncommand2\ncommand3" | telnet 192.168.1.100 23
```

This will send the specified commands (`command1`, `command2`, and `command3`) to the Telnet server running on the target host.

Keep in mind that Telnet is an insecure protocol, and it is recommended to use more secure alternatives such as SSH whenever possible.
```
Protocol_Name: Telnet    #Protocol Abbreviation if there is one.
Port_Number:  23     #Comma separated if there is more than one.
Protocol_Description: Telnet          #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for t=Telnet
Note: |
wireshark to hear creds being passed
tcp.port == 23 and ip.addr != myip

https://book.hacktricks.xyz/pentesting/pentesting-telnet

Entry_2:
Name: Banner Grab
Description: Grab Telnet Banner
Command: nc -vn {IP} 23

Entry_3:
Name: Nmap with scripts
Description: Run nmap scripts for telnet
Command: nmap -n -sV -Pn --script "*telnet*" -p 23 {IP}

Entry_4:
Name: consoleless mfs enumeration
Description: Telnet enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_version; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/brocade_enable_login; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_encrypt_overflow; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_ruggedcom; set RHOSTS {IP}; set RPORT 23; run; exit'

```
<figure><img src="../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>

[**DragonJAR Security Conference是一场国际网络安全活动**](https://www.dragonjarcon.org/)，将于2023年9月7日至8日在哥伦比亚波哥大举行。这是一个内容丰富的技术活动，展示了最新的西班牙语研究成果，吸引了来自世界各地的黑客和研究人员。\
立即在以下链接注册，不要错过这个重要的会议！:

{% embed url="https://www.dragonjarcon.org/" %}

<details>

<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
* 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或在**Twitter**上**关注**我[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**

</details>