# Telnet

> Telnet is a plaintext remote access protocol. Attackers grab banners, brute force weak creds, intercept traffic via MITM, then pivot internally using gained shell access

- **URL:** https://hackindex.io/services/telnet
- **Type:** Service
- **Default ports:** 23
- **Tags:** telnet, remote-access, unencrypted, linux, network, plaintext
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

Telnet runs on **TCP port 23** and provides unencrypted remote terminal access. Nmap identifies it as `telnet`. It is largely replaced by SSH, but still appears on legacy systems, network equipment, and IoT devices.

All Telnet traffic, including credentials, is transmitted in plaintext. This makes it trivial to intercept on a shared network. Many devices ship with default or blank Telnet credentials, and some expose Telnet as a hidden management interface.

Connect with a Telnet client or netcat to grab the banner and identify the device. Check for default credentials, blank passwords, and command injection in login prompts. Network captures may reveal credentials from other users connecting to the service.

## Phases

- [Enumeration](https://hackindex.io/services/telnet/enumeration.md): Grab banners, versions, and NTLM info from Telnet services (1 guides)
- [Exploitation](https://hackindex.io/services/telnet/exploitation.md): Guides on brute forcing, weak creds, and MITM attacks on Telnet (3 guides)