In this lecture, we are going to learn talent, exploitation.
Telnet is an application protocol which allows you with the use of a Telnet client to connect to and
execute commands on a remote machine that is hosting a talent server.
The Telnet client will establish a connection with the server.
The client will then become a virtual terminal, allowing you to interact with the remote host.
Telnet sends all commands in clear text and has no specific security mechanisms.
Thus, in many applications and services, Telnet has been replaced by SSH in most implementations.
To scan for telnet ports.
You can use Nmap.
Normally the Telnet is running on port 23.
However, it is always the best practice to scan for all ports.
Connecting with Telnet is very easy.
You can use the command Telnet IP address of the machine and the port number to connect to the machine.
Telnet is often used to connect to back doors from the attacker's machine.
Now let's see the demonstration.
I'm using the services room from Tryhackme, which is a very good room for learning exploiting network
services.
Let's first answer some basic questions about Telnet.
To understand the protocol better.
So the first question is what is Telnet?
Telnet is an application protocol.
So the second question is what has slowly replaced Telnet?
SSH has replaced Telnet.
The next question is how to connect to a Telnet server with a given IP and port number.
You can use simple Telnet command, specify the IP and port number.
So the lack of word means that alternate communication is in plain text.
So there is no encryption.
Now start your machine.
Once you get the IP address.
Launch your Nmap scan.
Use SS.
Coastal scan for version enumeration.
Dash O is for OS fingerprinting.
And we do not have any port open.
Nmap default scan scans for only 12,000 ports.
Now let's just rerun the scan on all ports.
So relaunch the scan with the flag.
Dash.
And now we get some results.
So there is Port 801 to open.
And it seems some kind of a back door.
Which kid is back door as a label?
So let's just answer the questions.
So there is only one port open on the target machine.
It is 8012.
So based on the data returned to us, what do we think this port could be used for, which is a back
door?
And we have already seen a possible username.
Which is good.
Now complete the task.
Now let's just connect to this back door.
Through the command Telnet specify your machine IP and the port number.
And we are connected.
So we can run different commands on a target machine.
Let's first of all start a tcpdump listener on our attacker's machine to check whether we can ping our
attacker's machine from the target machine.
Use the command sudo tcpdump IP protocol ICMP and specify the interface with a flag.
No connect to the target machine.
Use dot help to view all commands.
Then use the command dot run and try to ping the attacker's machine.
So we do receive the ping from the target machine.
To answer the same on Try hack Me.
So in the next task, we will try to achieve a reverse shell with MSF banner.
On your attacker's machine.
Use the command MSF venom to list all payloads and filter for netcat payloads.
So we have a command UNIX reverse netcat payload.
To use it.
Use the command dash P, specify the payload, specify the IP address of the Kali machine and the port
number and your payload will be generated.
Copy it.
Now start the Netcat listener on your attacker machine with NC dash triple for command.
Now back on the target machine, Try to run it with run command.
And we do get a reverse shell.
Use to list down the contents of the current directory and we have a flag dot text file.
And we are actually root.
Get out the contents of this flag file with cat command.
And we do have a flag.
Copy the flag.
Now let's just answer the questions on Tryhackme.
Paste your flag and submit it.
Try Hack Me also asks for the command that we use to start our listener.
So we use Netcat Lvbp command to start the listener.
The next question is what word does the generated payload start with?
It is mkfifo.
So in this video, we have learned how we can use Telnet to exploit a target machine.
I hope you liked this lecture and see you in the next lecture.