Telnet commonly carries its username/password exchange in plaintext unless an encryption extension is successfully negotiated. Authentication fails in three common ways: a device retains vendor defaults, a service requires no authentication and drops directly to a shell or menu, or an online password attack succeeds against weak credentials. A valid login yields a terminal whose privileges depend on the particular device and account.
nc <target> 23 # try default/no-auth first
hydra -L users.txt -P passwords.txt telnet://<target> -t 4
Subtopics#
- Default credentials: vendor and factory Telnet logins.
- No authentication: servers that drop to a shell without a password.
- Password brute force: online attacks against weak login credentials.