Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-telnet.md
Translator workflow a21a0e7217 Translated to Chinese
2023-08-03 19:12:22 +00:00

7.4 KiB
Raw Blame History

23 - Telnet渗透测试

☁️ HackTricks云 ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

DragonJAR Security Conference是一场国际网络安全活动，已经举办了十多年，将于2023年9月7日至8日在哥伦比亚波哥大举行。这是一个内容丰富的技术活动，展示了吸引全球黑客和研究人员的最新研究成果。
立即在以下链接注册，不要错过这个重要的会议！:

{% embed url="https://www.dragonjarcon.org/" %}

基本信息

Telnet是一种网络协议，为用户提供了一种不安全的方式通过网络访问计算机。

**默认端口：**23

23/tcp open  telnet

枚举

获取横幅信息

nc -vn <IP> 23

所有有趣的枚举都可以通过nmap进行执行：

nmap -n -sV -Pn --script "*telnet* and safe" -p 23 <IP>

脚本 telnet-ntlm-info.nse 将获取 NTLM 信息（适用于 Windows 版本）。

在 TELNET 协议中，有各种 "选项"，可以通过 "DO, DON'T, WILL, WON'T" 结构进行制定，并可用于允许用户和服务器同意使用更复杂（或者可能只是不同）的约定集来进行 TELNET 连接。这些选项可能包括更改字符集、回显模式等（来自 telnet RFC）
我知道可以枚举这些选项，但我不知道如何操作，所以如果你知道，请告诉我。

暴力破解

配置文件

/etc/inetd.conf
/etc/xinetd.d/telnet
/etc/xinetd.d/stelnet

HackTricks 自动命令

Telnet

Telnet is a network protocol used to establish a remote shell session with a host over the Internet. It is commonly used for remote administration and debugging purposes. However, Telnet is considered insecure because it transmits data in plain text, making it vulnerable to eavesdropping and interception.

To automate Telnet commands, you can use the following syntax:

echo -e "command1\ncommand2\ncommand3" | telnet <host> <port>

Replace <host> with the target host IP address or domain name, and <port> with the target port number.

For example, to automate Telnet commands to a host with IP address 192.168.1.100 on port 23, you can use the following command:

echo -e "command1\ncommand2\ncommand3" | telnet 192.168.1.100 23

This will send the specified commands (command1, command2, and command3) to the Telnet server running on the target host.

Keep in mind that Telnet is an insecure protocol, and it is recommended to use more secure alternatives such as SSH whenever possible.

Protocol_Name: Telnet    #Protocol Abbreviation if there is one.
Port_Number:  23     #Comma separated if there is more than one.
Protocol_Description: Telnet          #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for t=Telnet
Note: |
wireshark to hear creds being passed
tcp.port == 23 and ip.addr != myip

https://book.hacktricks.xyz/pentesting/pentesting-telnet

Entry_2:
Name: Banner Grab
Description: Grab Telnet Banner
Command: nc -vn {IP} 23

Entry_3:
Name: Nmap with scripts
Description: Run nmap scripts for telnet
Command: nmap -n -sV -Pn --script "*telnet*" -p 23 {IP}

Entry_4:
Name: consoleless mfs enumeration
Description: Telnet enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_version; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/brocade_enable_login; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_encrypt_overflow; set RHOSTS {IP}; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_ruggedcom; set RHOSTS {IP}; set RPORT 23; run; exit'

DragonJAR Security Conference是一场国际网络安全活动，将于2023年9月7日至8日在哥伦比亚波哥大举行。这是一个内容丰富的技术活动，展示了最新的西班牙语研究成果，吸引了来自世界各地的黑客和研究人员。
立即在以下链接注册，不要错过这个重要的会议！:

{% embed url="https://www.dragonjarcon.org/" %}

☁️ HackTricks云 ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥