-2

So I was scanning a clients computer and nmap came up with two open ports: 6002 and 9002. Both are running Telnet and both have the same banner in Spanish:

telnet banner

Spanish to English translation You are accessing a private machine. Unauthorized access or improper use is prohibited

Never exploited Telnet so I'm honestly not sure where to begin. This seems like an odd port for it to run on. The only service I know of that runs on this port is X11:2. I tried running a list of usernames and passwords in Metasploit with auxiliary/scanner/telnet/telnet_login to no avail. Any hints or tips someone might be able to give me? Thanks.

EDIT:

I found an interesting read that suggests this is a flaw having to do with the Cisco ISR G2 routers. It says that even though 6002 and 9002 aren't supposed to be listening they still are and actually provide an interface for Telnet. I checked port 2002 which also did the same and 4002 shows a blank screen exactly as described in the article I linked.

UPDATE: After trying an extensive list of default credentials from the Cisco site itself as well as other sources on Github and so forth I am unable to find any particular method that works. After researching more about this flaw in Cisco routers I still am not sure how to exploit this. If by tomorrow there are no better answers I will place a bounty on this question.

Improve this question
4
  • What outcome are you expecting? What's your question? You found telnet. Ok. What's exploitable about the situation is that you might be able to capture credentials in the clear if someone else connects. What are you hoping to "exploit" remotely?
    – schroeder ♦
    Sep 23, 2018 at 11:50
  • @schroeder It's a remote system, I can't get physical access to capture communication. Furthermore, I think this is something someone forgot or isn't aware exists on the router. I'm hoping to gain unauthorized access via the telnet application. And seeing as how the router is listening on these ports because of a flaw, and they act irregularly when supplying the telnet services, I was sure there was some attack vector not normally present that perhaps I'm missing.
    – Edward Severinsen
    Sep 23, 2018 at 16:07
  • What I'm hoping to do with this of course is elevate privileges. What is the point of exploiting other than to do such? I'm looking to exploit in the way of gaining some kind of control or access. Either successfully logging into Telnet or finding a buffer overflow vulnerability I can use for remote code execution, etc.
    – Edward Severinsen
    Sep 23, 2018 at 16:09
  • There are lots of reasons to exploit. But anyway, let's break down your question: you found an open telnet port on a remote Cisco box, you tried brute forcing it but could not find the right credentials, and you want to know what to do. There is no reason to assume there is something to "exploit". At this point, the only thing you can do with this is try to log in. It doesn't matter that the owner might not know telnet is open.
    – schroeder ♦
    Sep 23, 2018 at 17:02

1 Answer 1

Reset to default
2

"User Access Verification" is a string associated with Cisco routers and switches, and Didier Stevens describes finding those ports open with telnet and allowing default passwords on a Cisco router.

As an attacker, you should research known Cisco default credentials and try them.

As a defender, the solution may be simply to put ACLs in place to block those ports.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .