Telnet

Telnet

Telnet on TCP 23 provides remote terminal access with no encryption, so credentials, commands, and output cross the network in cleartext. Its surface is weak authentication (defaults, no-auth, brute force), a verbose banner that discloses the OS, memory-corruption RCE in old telnetd implementations, and interception of the cleartext session for credentials and hijacking.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

Telnet is a remote-terminal protocol commonly exposed on TCP 23. Its default data stream is plaintext, so the login, password, commands, and output are visible to a positioned observer. Extensions such as the Telnet ENCRYPT option exist, but support and successful negotiation must be verified and the historic algorithms are not a substitute for SSH. Telnet persists on legacy systems, network equipment, and IoT devices, where its attack surface includes weak authentication, verbose identification, implementation-specific vulnerabilities, and interception or live hijacking of sessions that remain plaintext.

bash

nmap -p23 -sV --script telnet-ntlm-info,telnet-encryption <target>
nc <target> 23                                 # banner and login prompt

Subtopics#

Enumeration: banner and OS detection.
Authentication: defaults, no-auth, and brute force.
Memory corruption: RCE in telnetd implementations.
Traffic interception: cleartext capture and session hijacking.

Subtopics#

References#