| Service | Port | Notes |
|---|---|---|
| Telnet | 23/tcp | Cleartext remote login, same accounts as SSH |
Why It Exists
Telnet was the standard remote-login protocol long before SSH existed, and legacy network gear and older systems kept using it well past the point encrypted alternatives were available. Metasploitable 2 keeps it enabled specifically so the risk of cleartext credentials is something you can observe directly, not just take on faith.
How It's Identified
Capturing network traffic during a Telnet login shows the username and password moving as readable plain text:
sudo tcpdump -i eth0 -A -s0 port 23
Run on the attacking VM's interface while a Telnet login happens on the lab network. The -A flag prints packet contents as ASCII, so the credentials appear directly in the terminal output.
The same documented default accounts that work over SSH and at the console — see default credentials — work identically here, which is why this page pairs naturally with a packet-capture exercise rather than a separate exploit.
The Lesson
Encryption in transit isn't a nice-to-have for anything handling credentials, and "it's only on the internal network" is not a substitute for it — internal traffic can still be observed by anything else on that same network segment, including a compromised device, a misconfigured switch port, or another VM sharing the same host-only network.
How Defenders Mitigate It
Disable Telnet entirely on any system that needs remote access, and standardize on SSH with key-based authentication instead. Where legacy hardware genuinely can't be replaced, isolate it onto its own restricted network segment so a cleartext capture at least can't reach anything else of value.
Only interact with this service inside your own isolated Metasploitable 2 lab. Testing it against a system you don't own or have written permission to test is illegal in most jurisdictions.
Related: the SSH page for the encrypted alternative, and network configuration for keeping this traffic contained to your lab.
FAQ
Is Telnet ever appropriate to use today?
Essentially never for anything carrying credentials or sensitive data. Some isolated serial-console-style use cases persist, but general remote administration should use SSH.
How is a credential capture demonstrated safely?
By capturing traffic only on your own isolated host-only lab network, never on a shared or production network.
Does Telnet use the same login credentials as SSH on Metasploitable 2?
Yes. It's the same underlying account system, so the documented default credentials (such as msfadmin) work identically over Telnet, SSH, or the console.
What tool is typically used to demonstrate Telnet credential capture?
A packet capture tool such as Wireshark or tcpdump, run on the isolated lab network while a Telnet login occurs. The captured stream can be reassembled to show the plaintext username and password.