#########################################################################################
# TELNET Settings
#########################################################################################

[config]
default_port = 23
protocol	 = tcp
categories 	 = recon, defaultcreds, bruteforce

[specific_options]
telnets = boolean


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap Telnet scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='telnet-* AND NOT telnet-brute*' --stats-every 10s [IP]

# Nmap scripts does not retrieve full Telnet banner, but often only the first bytes
# It is better to use a dedicated script to perform full banner grabbing
[check_banner-grabbing]
name        = banner-grabbing
category    = recon
description = Grab full banner from Telnet service
tool        = grabtelnet
command_1   = python3 grabtelnet -d [IP] -p [PORT] -v


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on Telnet
# tool        = patator
# command_1   = patator telnet_login host=[IP] port=[PORT] inputs='COMBO00\nCOMBO01' 0=[WORDLISTSDIR]/telnet/telnet_default_combo.txt persistent=0 prompt_re='Username:|Password:' -x ignore:egrep='Login incorrect.+Username:'
tool        = hydra
command_1   = hydra -C "[WORDLISTSDIR]/services/telnet/telnet-default-combo2.txt" -s [PORT] -v -V -I [IP] telnet[TELNETS true="s"]
command_2   = hydra -L "[WORDLISTSDIR]/services/telnet/telnet-common-usernames.txt" -P "[WORDLISTSDIR]/telnet/telnet-common-passwords.txt" -s [PORT] -e nsr -v -V -I [IP] telnet[TELNETS true="s"]


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce Telnet accounts
# tool        = patator
# command_1   = python2.7 patator.py telnet_login host=[IP] port=[PORT] inputs='root\nFILE0' 0=[WORDLISTSDIR]/passwords/pass-medium.txt persistent=0 prompt_re='Username:|Password:' -x ignore:egrep='Login incorrect.+Username:'
tool        = hydra
# Run bruteforce only if no creds found/known
command_1   = hydra -L "[USERLIST default="services/telnet/telnet-usernames-short.txt"]" -P "[PASSLIST default="passwords/pass-short.txt"]" -e nsr -v -V -I [IP] telnet[TELNETS true="s"]
context_1   = { 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = hydra -l '[USERNAME]' -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -e nsr -F -v -V -I [IP] telnet[TELNETS true="s"]
context_2   = { 'auth_status': USER_ONLY }
# Known issue with Hydra : might return lots of [ERROR] Not a TELNET protocol or service shutdown
# Test with Medusa does not solve problem. Maybe, should move to patator ?