Offensive Security Researcher & Quantum Cryptography Analyst

What Telnet Is and How Hackers Have Used Telnet for Exploitations

Abdul Wahab Junaid
What Telnet Is and How Hackers Have Used Telnet for Exploitations

What is Telnet?

Telnet (Teletype Network) is a network protocol and a command-line tool that provides a bidirectional, interactive text-oriented communication facility using a virtual terminal connection. It was developed in 1969 and standardized by the IETF as RFC 15.

Its primary purpose is to allow a user on one computer (the Telnet client) to log in to a remote computer (the Telnet server) and execute commands as if they were sitting at the remote computer’s terminal. This makes it an essential tool for system administrators for remote management of servers, network devices (like routers and switches), and other systems.

Crucial Note on Security: Telnet transmits all data, including usernames and passwords, in plain text. This makes it extremely vulnerable to eavesdropping (packet sniffing). For this reason, it has been almost entirely replaced by the SSH (Secure Shell) protocol for any secure remote administration. Telnet is now primarily used for:

Working of Telnet (The Protocol)

Telnet operates on a client-server model.

  1. Connection Establishment: The Telnet client initiates a TCP connection to the Telnet server on the well-known port 23 (or another specified port).
  2. Negotiation (Option Handling): Once the connection is established, the client and server negotiate terminal settings and capabilities. This is done using a series of control commands. They agree on parameters like echo, line mode, and terminal type. This process ensures the server knows how to interpret the client’s keystrokes and format its output correctly.
  3. Terminal Interaction:
    • The user types commands on the client machine.
    • The Telnet client sends these keystrokes to the server.
    • The Telnet server receives the characters, interprets them as commands for its operating system, and executes them.
    • The output (the result of the command) is sent back from the server to the client.
    • The client displays this output to the user.
  4. Connection Termination: The session ends when the user logs out or the connection is terminated by either end.

A key concept in Telnet is the Network Virtual Terminal (NVT). The NVT is a standardized, hypothetical device that provides a common ground for communication. Both the client and server map their native terminal characteristics to the NVT, allowing a client on one type of system (e.g., Windows) to communicate with a server on a completely different system (e.g., Linux).

Ports Used by Telnet

Common Telnet Commands

These commands are used within the Telnet client after it has started.

CommandDescriptionExample
openEstablishes a connection to a host.open 192.168.1.10
closeCloses the current connection.close
quitExits the Telnet client entirely.quit
statusDisplays the current status of the Telnet client (connected or not, etc.).status
setSets terminal options (rarely used by average users).set escape ^C
unsetUnsets terminal options.unset echo
? or helpDisplays help information for all commands or a specific command.help open

How to use:

  1. You can start the client and then use the commands: telnet -> open example.com
  2. Or, connect directly from the command line: telnet example.com 23

In which TCP/IP Protocol Layer does Telnet lie?

Telnet is an Application Layer protocol in the TCP/IP model.

This placement is because Telnet is a user-facing application that provides a specific service (remote terminal access) using the reliable transport services of TCP.

Which Language is Telnet Written In?

This question has two parts:

  1. The Telnet Protocol Specification: This is not “written” in a programming language. It is a standard, defined in documents like RFC 854 (the core NVT concept) and others. It’s a set of rules that any developer can implement.
  2. Telnet Implementations (Client & Server Software): The original implementations were written in C, as were the versions included with early UNIX and Linux distributions. The Telnet client found in modern Windows operating systems is also written in C/C++.

However, because the protocol is open, Telnet clients and servers can be and have been written in almost any programming language that supports network socket programming, including:

For example, a system administrator might write a Python script using telnetlib to automate the process of logging into a network switch, running a command, and collecting the output.

The Motivation for Telnet’s Development

Telnet was developed in the late 1960s to solve specific problems with the computing landscape of that era. Computers then were large, expensive, and shared by multiple users, who had to access them through a physical terminal.

The Problems Telnet Addressed

There were two main issues that Telnet was designed to solve:

  1. Multiple Terminals per User: In organizations with several computers, a user needing to access each machine would require a separate, costly terminal for each one. This was inefficient and expensive. The text compares this to having a room full of televisions, with each one only able to show a single channel.
  2. Remote Access Inefficiency: To access a computer at a different physical location, a dedicated data circuit was required to connect a user’s terminal to that specific remote machine. Each circuit only allowed access to one machine, making it a very expensive and difficult process to scale.

The Telnet Solution

Telnet was created to provide a more general and flexible solution. It acted as an application protocol that ran on top of the emerging physical network and the TCP/IP protocol suite. This allowed any terminal to establish a session with any networked computer, eliminating the need for dedicated terminals and expensive, one-to-one data circuits. Essentially, Telnet enabled a user to log in and use a remote computer as if they were directly connected to it.

How Telnet Works: A Client/Server Deep Dive

Telnet’s core function is to enable a user on one machine to access and use another machine as if it were a local connection. This makes Telnet an inherently client/server protocol, a common model in many TCP/IP applications.

Client/Server Operation

Telnet and TCP Sessions

Telnet is designed for interactive communication over a prolonged period, so it is built upon a session-based model. For this reason, it relies on the Transmission Control Protocol (TCP), which is a connection-oriented protocol.

Telnet servers “listen” for connection requests on a well-known port: TCP port number 23.

The TCP Connection Process

  1. When a client wants to connect to a specific server, it initiates a TCP connection.
  2. The server responds, and a TCP three-way handshake is performed to set up the connection.
  3. This TCP connection is then maintained for the entire duration of the Telnet session, which can last for hours, days, or even weeks.
  4. TCP’s quality of service features ensure that data is delivered reliably and in the correct order, and that the data transfer rate is managed appropriately for both the client and the server.

A Telnet server can support many simultaneous sessions from different users. It keeps each session distinct by identifying it using the client’s IP address and port number.

Data Flow and Session Interaction

Since TCP is a full-duplex protocol, both the client and the server can send information to each other at any time during the Telnet session.

With the TCP connection established, the Telnet client and server act as a bridge between the user and the remote host. To the user, the Telnet session feels identical to sitting at a terminal directly connected to the remote machine. The session usually begins with the server sending a login prompt asking for a username and password. Once the user provides valid information, they are logged in and can use the host according to their account’s permissions.

Beyond Remote Login

While Telnet is most commonly associated with remote login, its protocol is flexible enough for a variety of functions. The administrator of the computer running the Telnet server decides how it will be used.

For example, a Telnet server can be directly interfaced with a program or service. The article recalls a public Internet server that provided weather information via Telnet. Instead of a login prompt, users would see a menu of weather options.

Key Takeaway: Telnet is a client/server protocol that uses TCP to create a reliable session between a user terminal and a remote host. The client handles user input, while the server manages the connection to the host. While often used for remote logins, the protocol’s design is versatile and can be used for various other purposes.

Summary of Key Points

AspectDetail
Full NameTeletype Network
PurposeRemote terminal access and command execution
Key FeatureText-based, bidirectional communication
Key WeaknessNo encryption (all data is sent in plain text)
Default PortTCP 23
Underlying TransportTCP (Reliable, connection-oriented)
TCP/IP LayerApplication Layer
ArchitectureClient-Server
Common Use TodayTesting open ports and debugging network services
Secure AlternativeSSH (Secure Shell)
Implementation LanguagePrimarily C, but possible in any language (Python, Java, etc.)

Understanding the Telnet Command Structure

The basic syntax is:

telnet [OPTIONS] [HOST [PORT]]

General Options (With Examples)

1. -4 / -6: Force IP Version

Example:

telnet -4 google.com 80

Explanation: This command tries to connect to google.com on port 80 (HTTP) but will only use an IPv4 address for the connection, even if an IPv6 address is available.

2. -a / -l: Automatic Login

Example:

telnet -l myusername 192.168.1.15

Explanation: This command connects to the Telnet server at 192.168.1.15 on port 23 and automatically sends the username myusername to the remote host. You will still likely be prompted for a password. This is highly insecure as the password is still sent in plain text.

3. -d: Debug Mode

Example:

telnet -d example.com 25

Output & Explanation:

telnet: Trying 93.184.216.34...
telnet: Trying 2606:2800:220:1:248:1893:25c8:1946...
telnet: Connected to example.com.
telnet: Escape character is '^]'.

This shows you the exact IP addresses (both IPv4 and IPv6) that Telnet is trying to connect to, and confirms when the connection is established.

4. -e: Set Escape Character

Example:

telnet -e ^# 192.168.1.1

Explanation: This connects to 192.168.1.1. During the session, instead of pressing Ctrl+] to get the telnet> prompt, you would press Ctrl+#. The ^ symbol represents the Ctrl key.

5. -E / -8 / -L: Data and Escape Control

Example:

telnet -E 192.168.1.1

Explanation: Connects to the device, and you are “stuck” in the session until the remote server disconnects or you close your terminal window, as you can’t use Ctrl+] to escape.

6. -n: Trace to File

Example:

telnet -n trace.log google.com 80

Explanation: After running this, the file trace.log will contain a complete log of every byte transmitted during the Telnet session to Google’s web server. This is a powerful tool for protocol analysis.

7. -r: Rlogin Mode

Encryption and Authentication Options (-x, -k, -X)

These options are largely obsolete and ineffective. They were attempts to add security to Telnet but were never widely adopted or standardized. The encryption was weak and vulnerable. The industry-standard solution was to abandon Telnet entirely in favor of SSH, which was built with strong encryption from the ground up.

You should never rely on these options for security. Use SSH instead.

Most Common Modern Use: Testing Network Services

The most practical use for telnet today is as a simple network diagnostic tool to check if a TCP port is open and if a service is responding.

Live Example 1: Testing a Web Server (HTTP)

telnet google.com 80

What happens:

  1. The Telnet client establishes a TCP connection to google.com on port 80.
  2. If the connection is successful, you get a blank screen with a cursor. This means the port is open and a service (likely an HTTP server) is listening.
  3. You can now type an HTTP command. Since it’s a text-based protocol, this works.
    http GET / HTTP/1.1 Host: google.com (Press Enter twice)
  4. The web server will respond by dumping the raw HTTP headers and the HTML content of Google’s homepage directly into your Telnet window! This proves the connection is fully functional.

Live Example 2: Testing an Email Server (SMTP)

telnet mx.example.com 25

What happens:

  1. Connects to the mail server on port 25.
  2. If successful, the SMTP server will send a welcome banner, e.g., 220 mail.example.com ESMTP Postfix.
  3. You can then interact with it using SMTP commands:
    smtp EHLO test.com MAIL FROM: <test@test.com> RCPT TO: <user@example.com> DATA This is a test email from telnet. . QUIT
    This allows you to test and debug the mail server manually.

Live Example 3: Checking if a Port is Open

telnet 192.168.1.10 22

Summary

While its original purpose (remote login) is now obsolete due to security concerns, the Telnet client remains a valuable tool in a network administrator’s or developer’s toolkit precisely because it’s a “dumb” raw TCP client. Its ability to connect to any port and send/receive plain text makes it perfect for quick service checks and protocol debugging. The options in the help menu (-d, -n, -e) give you fine-grained control over how you conduct these tests.

Exit mobile version