So I was scanning a clients computer and
nmap came up with two open ports:
9002. Both are running Telnet and both have the same banner in Spanish:
Spanish to English translation You are accessing a private machine. Unauthorized access or improper use is prohibited
Never exploited Telnet so I'm honestly not sure where to begin. This seems like an odd port for it to run on. The only service I know of that runs on this port is X11:2. I tried running a list of usernames and passwords in Metasploit with
auxiliary/scanner/telnet/telnet_login to no avail. Any hints or tips someone might be able to give me? Thanks.
I found an interesting read that suggests this is a flaw having to do with the Cisco ISR G2 routers. It says that even though 6002 and 9002 aren't supposed to be listening they still are and actually provide an interface for Telnet. I checked port 2002 which also did the same and 4002 shows a blank screen exactly as described in the article I linked.
UPDATE: After trying an extensive list of default credentials from the Cisco site itself as well as other sources on Github and so forth I am unable to find any particular method that works. After researching more about this flaw in Cisco routers I still am not sure how to exploit this. If by tomorrow there are no better answers I will place a bounty on this question.