metasploit-cursor-harness: Skill for Cursor

Telnet Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Telnet transmits credentials in cleartext. Capture only within authorized scope.

Ports and detection

Port	Service
23/tcp	Telnet (cleartext remote terminal)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 23
nmap -n -sV -Pn --script "*telnet* and safe" -p 23 <target>

Workflow

Task Progress:
- [ ] Banner grab and version ID
- [ ] Default credential testing
- [ ] Brute force with vendor wordlists
- [ ] IoT/router expect automation
- [ ] Legacy exploit checks
- [ ] Document findings

Banner and NTLM info

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 23}
)

CLI fallback:

nmap -p23 --script telnet-encryption,telnet-ntlm-info <target>
# Microsoft Telnet: discloses NetBIOS, DNS, OS build

Authentication brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/telnet/telnet_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 23,
    "USERNAME": "admin",
    "PASSWORD": "admin",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -L users.txt -P passwords.txt <target> telnet -f -t 4
medusa -h <target> -U users.txt -P passwords.txt -M telnet
nmap -p23 --script telnet-brute --script-args userdb=users.txt,passdb=pass.txt <target>

Vendor default credentials

Vendor / Device	Username	Password
Cisco router/switch	cisco, admin	cisco, admin
D-Link	admin	(blank)
Netgear	admin	password
TP-Link	admin	admin
Ubiquiti	ubnt	ubnt
Zyxel	admin	1234
Huawei	admin	admin
Mikrotik	admin	(blank)
APC PDU	apc	apc
Axis camera	root	pass
Hikvision	admin	12345