Telnet Honeypot

Detect unauthorized access attempts targeting Telnet services.

About Telnet

Telnet is a legacy remote access protocol still commonly found on network equipment, industrial control systems, and IoT devices. Despite being unencrypted, Telnet remains active on many internal networks, making Telnet credentials valuable targets for lateral movement.

What Gets Captured

When an attacker attempts to connect using your Telnet honeypot credentials, Tripwires captures:

• Username - The username entered during login
• Password attempt - The password entered (transmitted in cleartext)
• Commands - The honeypot “logs the attacker in” to a fake BusyBox shell and records every command they run (e.g. wget, cat /etc/passwd, uname -a), revealing their intent
• Source IP - The attacker's IP address
• Timestamp - Exact time of the connection

The honeypot is also a tarpit: it deliberately delays every prompt and response, so a scripted brute force or command run is slowed to a crawl while every keystroke is logged. Automated tools waste their time on a box that goes nowhere.

Connection String Formats

Telnet credentials can be planted in various formats depending on your tech stack:

Telnet Command

telnet telnet-xxx.gettripwires.com 23

Expect Script

#!/usr/bin/expect
spawn telnet telnet-xxx.gettripwires.com
expect "login:"
send "user\r"
expect "Password:"
send "password\r"

Python (telnetlib)

import telnetlib
tn = telnetlib.Telnet('telnet-xxx.gettripwires.com', 23)
tn.read_until(b"login: ")
tn.write(b"user\n")
tn.read_until(b"Password: ")
tn.write(b"password\n")

Strategic Placement Ideas