Skip to content
HackIndex logo

HackIndex

Telnet Banner and Service Enumeration

1 min read Jan 3, 2026

Telnet runs plaintext on port 23. Exposed banners often leak OS, version, or device type. Positive hits flag legacy systems ripe for weak creds or known exploits.

Manual Banner Grab

Connect and observe initial output:

┌──(kali㉿kali)-[~]
└─$ nc -vn $TARGET_IP 23

Banner appears immediately or after newline. Look for strings like "Cisco", "FreeBSD", or version numbers.

Full interactive session:

┌──(kali㉿kali)-[~]
└─$ telnet $TARGET_IP 23

Once connected, escape to telnet prompt:

Ctrl + ]

Send control commands:

send ayt

Some servers reply with OS or version.

send ao

Triggers additional banner leakage on certain implementations.

No response or immediate disconnect indicates restricted banner.

Nmap Service Detection

Version probe:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 23 $TARGET_IP

Output shows software like "Linux telnetd" or "Cisco IOS". Match versions against CVEs.

Encryption negotiation check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 23 --script telnet-encryption $TARGET_IP

Reports if encryption offered. Plaintext confirmation means full session sniffing possible if pivoted.

NTLM info leak on Windows telnet:

┌──(kali㉿kali)-[~]
└─$ nmap -p 23 --script telnet-ntlm-info $TARGET_IP

Dumps domain, hostname, OS version if NTLM supported.

All safe telnet scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -n -sV -Pn -p 23 --script "telnet* and safe" $TARGET_IP

Combines version, encryption, and info scripts. Unexpected OS details guide next attacks.