Skip to content
HackIndex.io

Telnet Banner and Service Enumeration

4 min read Created Jan 3, 2026 Last updated Jan 3, 2026

Telnet Enumeration

Telnet runs plaintext on port 23. Exposed banners often leak OS, version, or device type. Positive hits flag legacy systems ripe for weak creds or known exploits. Finding telnet open in a modern environment is a strong signal. Network gear, embedded devices, and old UNIX hosts are the most common targets. IoT controllers, managed switches, and legacy routers frequently leave it enabled. Treat any open port 23 as a high-value finding worth full enumeration. Default credentials are common across these device classes.

Manual Banner Grab

Connect and observe initial output:

  • Manual Banner Grab
  • Nmap Service Detection
┌──(kali㉿kali)-[~]
└─$ nc -vn $TARGET_IP 23

Banner appears immediately or after newline. Look for strings like "Cisco", "FreeBSD", or version numbers. Note the full banner text before any interaction. Cisco banners often include the IOS version on the first line. FreeBSD and Linux banners may include kernel version or distribution name. If nothing appears, press Enter once to trigger the banner. Some devices delay output until the session is fully established. Record exact strings for CVE searching later.

Full interactive session:

┌──(kali㉿kali)-[~]
└─$ telnet $TARGET_IP 23

Once connected, escape to telnet prompt:

Ctrl + ]

Send control commands:

send ayt

AYT (Are You There) confirms the connection is alive; the server returns a liveness acknowledgement only, not OS or version info.

send ao

AO (Abort Output) discards buffered output being sent to the terminal; it does not trigger banner or version disclosure.

No response or immediate disconnect indicates a restricted or firewalled service. Some firewalls pass the TCP handshake but reset on data. If the banner never arrives, the service may be wrapped by TCP wrappers or a proxy. Try connecting from a different source IP to rule out IP-based filtering. An interactive login prompt reveals the authentication scheme. Failed login attempts sometimes disclose the OS in the error message. Note whether the prompt asks for a username first or presents a menu before credentials.

Nmap Service Detection

Version probe:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 23 $TARGET_IP

Output shows software like "Linux telnetd" or "Cisco IOS". Match versions against CVEs. Use the exact version string to search nvd.nist.gov or exploit-db.com. Version strings from Nmap are sometimes partial, so search broadly. A Cisco IOS version tied to a specific release year often has public CVEs for authentication bypass or buffer overflows. Old Linux telnetd builds have known remote vulnerabilities worth checking. Version detection fails when the banner is suppressed or non-standard. Fall back to manual connection and passive banner analysis in those cases.

Encryption negotiation check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 23 --script telnet-encryption $TARGET_IP

Reports if encryption offered. Plaintext confirmation means full session sniffing is possible if pivoted to the same network segment. A display filter of "telnet" in Wireshark captures the full session including keystrokes typed during login. On a shared segment, ARP spoofing gives you a sniffing position if port security is absent. Note plaintext confirmation as a standalone finding. It is relevant for credential capture and session hijacking during lateral movement.

NTLM info leak on Windows telnet:

┌──(kali㉿kali)-[~]
└─$ nmap -p 23 --script telnet-ntlm-info $TARGET_IP

Dumps domain, hostname, OS version if NTLM supported. This output does not require a successful login. The NTLM negotiation exposes metadata before any credentials are submitted. Domain name and hostname let you correlate with SMB, LDAP, and DNS findings across the engagement. OS version from NTLM is often more precise than Nmap version detection. Cross-reference the hostname against other open services to build a fuller host profile.

All safe telnet scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -n -sV -Pn -p 23 --script "telnet* and safe" $TARGET_IP

Combines version, encryption, and info scripts. Unexpected OS details guide next attacks. After these checks you should have the service version, whether encryption is negotiated, and any NTLM metadata. Use the version string to search for public exploits. Use OS and device info to prioritize credential sets. Network devices commonly ship with default credentials tied to the vendor and firmware version. If telnet is open on an IPMI or BMC interface, default credentials are worth testing immediately. Move to the Exploitation phase when credential testing is in scope.