When the Telnet stream remains plaintext, command interception exposes the interaction after login: commands, server output, secondary credentials typed during the session, and data viewed by the operator. A positioned attacker can reconstruct both directions of the TCP stream. If Telnet encryption or another protective transport is active, the capture does not reveal this application data directly.
# capture and reconstruct the full session
tcpdump -i eth0 -w telnet.pcap port 23
# Wireshark Follow TCP Stream shows the entire session (commands + output)
tshark -r telnet.pcap -q -z follow,tcp,ascii,0
Exploitation notes#
- Session capture frequently surpasses the login in value:
enable/su/sudopasswords entered mid-session, credentials for other systems, device configuration (including secrets in ashow running-config), and sensitive output all appear in the clear. - Reconstruct the full bidirectional stream to pair commands with their output; the client-to-server direction holds what the user typed, the server-to-client direction holds results.
- This is passive and quiet; combine with password sniffing from the same capture for the login plus everything after.
- For active control rather than observation, escalate to session hijacking.