Port 23

Question 1

What is Port 23?

Answer 1

Telnet.
Typically, this protocol is used to establish a connection to Transmission Control Protocol (TCP) port number 23, where a Telnet server application (telnetd) is listening. Telnet, however, predates TCP/IP and was originally run over Network Control Program (NCP) protocols.

Communication is sent in Plain Text.

Question 2

What are common Telnet (23) Attacks?

Answer 2

TELNET COMMUNICATION SNIFFING
TELNET BRUTE FORCE ATTACK
DOS ATTACK

Question 3

How to Sniff Telnet communication.

Answer 3

The basic set up is two routers communicating to each other through a hub. The user has a PC connected to the Hub between the two routers.

Use PuTTY to start a telnet session. Type host name (i.p. of target system) and press go.

The user connects to router 2 from Router 1 using telnet entering his user name and password in the process.

The attacker is using WireShark to sniff the packets between the two routers passing through the hub.

The conversatyion will be located in Statistics, Conversation, select the tcp conversation and click follow stream. Anything in red is commnand from user to server anything in blue is server to user.

Tools used. WireShark for sniffing
PuTTy to launch telnet connection. Alternatives include;
Solar-PuTTY
KiTTY
MobaXterm
mRemoteNG
Xshell 6
Bitvise SSH Client

Question 4

Blueprint for Telnet (23) Brute force.

Answer 4

Open nmap on Kali cmd bar.
Nmap parameters
-sT = Scan using TCP connect
-sV = Standard service detection
grep open = show only open ports.
1. nmap -sT -sV grep open
2. next type telnet
When prompted for login try standard log in credentials admin #, admin etc.
3. If you dont get type cmd ls (ls will list directories).
4. Select the directory where your brute force script is stored (this is the script which has all of the password combinations you want to try). For example ./telnet_brute.py
5. Terminal will now ask for the target i.p address. Enter target i.p address
6. Wterminal will ask for username, select something generic like administrator
7. Press enter and it will run your python scrip against the telnet IP (target server).
8. Once cracked the terminal will show the matching password.

Tools used nmap for initial scan. Python for password crack.

Question 5

Blueprint for DoS on Telnet (23)

Answer 5

1. hping3 -V (vebose) -c 1000 (number of packets) -d (size of packets 64 -150) -S (Syn flag) -p 23 –flood
2. With LOIC type, IP address or url, select packet size and port number and press go.

Tools used Hping3 for sending packets. LIOC - can be used for multiple different DoS. Nmap for the system scan.