Telnet, FTP, and Why Default Credentials Still Work in 2026

The first HTB box I completed was Meow famous as the easiest box on the platform, and often the first one anyone tries. The entire path to root was: scan the box, find Telnet open, log in with the username "root" and no password. That's it. No exploit chain, no clever payload. Just a service that should never have been left that way, configured exactly as it shipped out of the box.

It felt almost too simple. But it's precisely because it's simple that it matters Meow isn't a beginner's toy that teaches you nothing real. It's a near-perfect miniature of what actually shows up in enterprise networks more often than anyone likes to admit.

Why Telnet is still a problem

Telnet is a remote access protocol from the early days of networking, and it has one glaring flaw by modern standards: it transmits everything, including usernames and passwords, in plaintext. Anyone positioned to intercept that traffic can read it directly. SSH replaced it decades ago specifically to fix this, encrypting the entire session. And yet Telnet keeps turning up on legacy infrastructure, IoT devices, forgotten internal systems, and misconfigured servers nobody got around to hardening.

Finding Telnet open during a scan isn't just "one more open port." It's a signal: whoever set up this system either didn't know better or didn't finish the job. Both are worth investigating further.

Why default credentials are still a real attack path

Default credentials work embarrassingly often, and the mechanism is almost always the same: software or hardware ships with a preset username and password meant to be changed on first setup, and that step gets skipped. Sometimes it's an admin who meant to circle back. Sometimes it's a device deployed at scale where nobody thought to check. Either way, the credentials sitting in the vendor's default documentation still work in production.

This is exactly why credential wordlists like SecLists exist and why checking default creds is one of the very first things worth trying against any exposed login — before you reach for anything more advanced. It costs almost nothing to try, and the hit rate is higher than most people expect.

The real lesson, beyond the box

Meow is a lab box, so the stakes are zero. But the pattern it teaches is not a lab-only problem. Real breaches have happened this exact way: an exposed legacy protocol, a credential nobody changed, and an attacker who simply tried the obvious thing first. Sophisticated attacks make headlines. Simple oversights are what actually get exploited most of the time.

For anyone just starting out: don't skip the "easy" boxes, and don't assume the simple stuff isn't real security work. Recognizing when something is exposed insecurely and understanding why it matters is the same skill you'll use on far more complicated targets later. You're just seeing it without the noise for now.

I'm writing these as I go, working from Uganda toward cpts . More HTB write-ups to come as I build this out.