Telnet into Windows 8 machine

[Youssef Wagieh]

Hello, this program is exactly what I'm looking for! I want to use my Android phone to issue a command on my Windows 8 PC. I can't seem to make it work though.

Windows 8 PC IP-Address: 191.68.1.2 (port 23)

Username: X

Password: Y

Here's how I setup Send/Expect:

Pause 1000

Expect login:

Send X\r\n

Pause 500

Expect password:

Send Y\r\n

Pause 3000

Send serialsend /baudrate 9600 /devnum 24 y\r\n

Pause 500

It keeps giving me "Expect" timeouts at the first Expect in the sequence. If I leave the Expect lines in the sequence, it says "timeout waiting for data" when I execute after it runs for 10 seconds.

If I remove all Expect from the sequence, code is sent successfully (or so it says) but nothing happens on my PC.

If I telnet using Telnet app, I get login: then type my username and press enter, then get password: then type my password and press enter, then get C:\Users\Youssef> and type my "serialsend" command and press enter, it works fine.

[Youssef Wagieh]

Here's the log (replaced username and password with X and Y)

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {
    "timestamp": 1,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nPause 1000 milliseconds\nExpect: login:\nSend : X\\r\\n\nPause 500 milliseconds\nExpect: password:\nSend : Y\\r\\n\nPause 3000 milliseconds\nSend : serialsend /baudrate 9600 /devnum 24 y\\r\\n\nPause 500 milliseconds\n"
  },
  {
    "timestamp": 39,
    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {
    "timestamp": 39,
    "recordType": "Pause",
    "recordData": "1000"
  },
  {
    "timestamp": 1040,
    "recordType": "Expect",
    "recordData": "login:"
  },
  {
    "timestamp": 1040,
    "recordType": "Received Buffer Contains",
    "recordData": ""
  },
  {
    "timestamp": 4748,
    "recordType": "Received Bytes",
    "recordData": "21"
  },
  {
    "timestamp": 4748,
    "recordType": "Received Buffer Contains",
    "recordData": "��%�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },
  {
    "timestamp": 10003,
    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {
    "timestamp": 10003,
    "recordType": "Disconnect",
    "recordData": null
  },
  {
    "timestamp": 10004,
    "recordType": "Failed",
    "recordData": "timeout waiting for data"
  }
]

[David]

On Sunday, August 24, 2014 7:56:04 AM UTC-7, Youssef Wagieh wrote:

Here's the log (replaced username and password with X and Y)

   {

    "timestamp": 4748,
    "recordType": "Received Bytes",
    "recordData": "21"
  },

Here we see Send/Expect saying that it received 21 bytes.

 

  {
    "timestamp": 4748,
    "recordType": "Received Buffer Contains",
    "recordData": "��%�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },
 

And here we see that the Send/Expect log needs to do a better job of display binary or Unicode data in the receive buffer.  This is something I will work on for the next release.

But the problem here appears to be that the data doesn't look like "login"

What happens if you send a \n\r first?

[Youssef Wagieh]

Well that's the weird thing, when I telnet using a laptop or using the telnet app from the play store, the first thing that is expected is login:

Anyway here's the log when I try it without any Expect: (sorry can't use 'Insert code' option from mobile:

////

[
{
"timestamp": 0,
"recordType": "Start",
"recordData": "Standalone"
},
{
"timestamp": 0,
"recordType": "Version",
"recordData": "2000020"
},
{

"timestamp": 0,
"recordType": "Send/Expect Data",
"recordData": "Timeout milliseconds: 10\nPause 1000 milliseconds\nSend : X\\r\\n\nPause 500 milliseconds\nSend : Y\\r\\n\nPause 3000 milliseconds\nSend : serialsend /baudrate 9600 /devnum 24 y\\r\\n\nPause 500 milliseconds\n"
},
{
"timestamp": 19,

"recordType": "Connection",
"recordData": "192.168.1.2:23"
},
{

"timestamp": 19,

"recordType": "Pause",
"recordData": "1000"
},
{

"timestamp": 1020,
"recordType": "Send",
"recordData": "X\\r\\n"
},
{
"timestamp": 1021,
"recordType": "Pause",
"recordData": "500"
},
{
"timestamp": 1521,
"recordType": "Send",
"recordData": "Y\\r\\n"
},
{
"timestamp": 1523,
"recordType": "Pause",
"recordData": "3000"
},
{
"timestamp": 4523,
"recordType": "Send",
"recordData": "serialsend /baudrate 9600 /devnum 24 y\\r\\n"
},
{
"timestamp": 4524,
"recordType": "Pause",
"recordData": "500"
},
{
"timestamp": 5025,

"recordType": "Disconnect",
"recordData": null
},
{

"timestamp": 5025,
"recordType": "Succeeded",
"recordData": null
}
]
////

[David]

Hello,

Can you try a profile where after the connection you send \r\n and then expect login?  And post the log?

Thanks.

[Youssef Wagieh]

Here you go:

Without pauses:

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {

    "timestamp": 1,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nSend : \\r\\n\nExpect: login:\n"
  },
  {
    "timestamp": 47,

    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {

    "timestamp": 47,
    "recordType": "Send",
    "recordData": "\\r\\n"
  },
  {
    "timestamp": 48,

    "recordType": "Expect",
    "recordData": "login:"
  },
  {

    "timestamp": 48,

    "recordType": "Received Buffer Contains",
    "recordData": ""

  },
  {
    "timestamp": 4567,

    "recordType": "Received Bytes",
    "recordData": "21"
  },

  {
    "timestamp": 4567,

    "recordType": "Received Buffer Contains",
    "recordData": "��%�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },

  {
    "timestamp": 9999,

    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {

    "timestamp": 10005,

    "recordType": "Disconnect",
    "recordData": null
  },
  {

    "timestamp": 10005,

    "recordType": "Failed",
    "recordData": "timeout waiting for data"
  }
]

With pauses:

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {

    "timestamp": 1,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nPause 1000 milliseconds\nSend : \\r\\n\nPause 500 milliseconds\nExpect: login:\nPause 500 milliseconds\n"
  },
  {
    "timestamp": 44,

    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {

    "timestamp": 44,

    "recordType": "Pause",
    "recordData": "1000"
  },
  {

    "timestamp": 1044,
    "recordType": "Send",
    "recordData": "\\r\\n"
  },
  {
    "timestamp": 1048,

    "recordType": "Pause",
    "recordData": "500"
  },
  {

    "timestamp": 1550,

    "recordType": "Expect",
    "recordData": "login:"
  },
  {

    "timestamp": 1550,

    "recordType": "Received Buffer Contains",
    "recordData": ""

  },
  {
    "timestamp": 4644,

    "recordType": "Received Bytes",
    "recordData": "21"
  },

  {
    "timestamp": 4644,

    "recordType": "Received Buffer Contains",
    "recordData": "��%�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },

  {
    "timestamp": 10006,

    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {

    "timestamp": 10008,

    "recordType": "Disconnect",
    "recordData": null
  },
  {

    "timestamp": 10008,

[David]

What language/locale are you telnet server and phone running?

[Youssef Wagieh]

Both are set to English (US). Phone is running OmniROM 4.4.4 if that would make a difference.

[David]

I wonder if the Windows telnet server is sending telnet protocol commands and waiting for a client response, before it sends the login prompt.  I hadn't ever looked at the telnet protocol before, but I would try to interpret those 21 bytes that Send/Expect is seeing.  

RFC 854 - Telnet Protocol Specification

Wikipedia telnet entry

Microsoft - The TELNET Protocol

I will try to get an updated version Send/Expect out tonight that displays the receive buffer log in hex.  In the meantime, can find the log file on the phone, and attach it here?   It will probably be located in:

/sdcard/data/Android/com.asif.plugin.sendexpect/files/sendexpect.log

[Youssef Wagieh]

I attached the log of sending \n\r and expecting login: here.

Also, I noticed this small line before the login: prompt when I try telnet-ing from a Windows 7 laptop into the Windows 8 machine:

I think that's the stuff that's "ufff" in the log. Right?

[David]

On Tuesday, August 26, 2014 11:46:39 AM UTC-7, Youssef Wagieh wrote:

Also, I noticed this small line before the login: prompt when I try telnet-ing from a Windows 7 laptop into the Windows 8 machine:

I think that's the stuff that's "ufff" in the log. Right?

Looks like it. I have no experience with Windows, but it looks you have NTLM authentication enabled on the Windows 8 telnet server and something needs to be sent to tell the server that your Send/Expect profile doesn't speak NTLM, but just wants to use a password.

[Youssef Wagieh]

Well, that's weird. The first string to be sent from all other telnet clients, when connecting, is the login: (username), regardless of the NTLM message that shows. I don't have to press enter or anything, just connect to the IP address and the first thing to type is the username. This happens from both Windows and from Android "https://play.google.com/store/apps/details?id=com.telnet&hl=en" clients.. Is there a way to just skip the NTLM message and send the login: that it asks for? Or put the above as "Expect" (I can't input the above symbols so maybe that won't work, I tried copying/pasting them, but that still didn't work)? Thanks a lot for your support mate anyway, really appreciated. :)

[David]

On Tuesday, August 26, 2014 11:52:37 PM UTC-7, Youssef Wagieh wrote:

Well, that's weird. The first string to be sent from all other telnet clients, when connecting, is the login: (username), regardless of the NTLM message that shows.

Not necessarily.  There is probably some handshaking/authentication going on between the telnet client and the telnet server before you see the prompt.  I suggest trying to disable the NTLM authentication as an experiment.  Here are some resources Google comes up with:

http://ntlmaps.sourceforge.net/ntlm.html

http://ntlmaps.sourceforge.net/telnet_ntlm.txt

  - This second link is particularly interesting as it shows the NTLM/telnet  startup exchange, and it looks similar to what you are seeing.

Microsoft - configure telnet server authentication

Microsoft - how to display current NTLM authentication state from telnet client

[Youssef Wagieh]

I disabled NTLM on the Win8 server and don't get the first couple of lines when Telnet-ing from the laptop to the Win8 PC. I get the following screenshot:

I tried setting the first Expect to "Welcome to Microsoft Telnet Service\n\nlogin: " and "Welcome to Microsoft Telnet Service\nlogin: " and "login: " and same 3 times without the space after "login: ".  Received Expect is 18 bytes this time, and also doesn't show in log correctly.

Here are 3 logs:

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {

    "timestamp": 0,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nPause 500 milliseconds\nExpect: Welcome to Microsoft Telnet Service\n\nlogin:\nSend : X\nPause 500 milliseconds\nExpect: password:\nSend : Y\nPause 1000 milliseconds\nSend : serialsend /baudrate 9600 /devnum 24 y\n"
  },
  {
    "timestamp": 12,

    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {

    "timestamp": 12,

    "recordType": "Pause",
    "recordData": "500"
  },
  {

    "timestamp": 512,
    "recordType": "Expect",
    "recordData": "Welcome to Microsoft Telnet Service\n\nlogin:"
  },
  {
    "timestamp": 512,

    "recordType": "Received Buffer Contains",
    "recordData": ""
  },
  {

    "timestamp": 4536,
    "recordType": "Received Bytes",
    "recordData": "18"
  },
  {
    "timestamp": 4536,

    "recordType": "Received Buffer Contains",

    "recordData": "�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },
  {
    "timestamp": 10002,

    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {

    "timestamp": 10003,

    "recordType": "Disconnect",
    "recordData": null
  },
  {

    "timestamp": 10003,

    "recordType": "Failed",
    "recordData": "timeout waiting for data"
  }
]

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {

    "timestamp": 0,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nPause 500 milliseconds\nExpect: login:\nSend : X\nPause 500 milliseconds\nExpect: password:\nSend : Y\nPause 1000 milliseconds\nSend : serialsend /baudrate 9600 /devnum 24 y\n"
  },
  {
    "timestamp": 11,

    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {

    "timestamp": 11,

    "recordType": "Pause",
    "recordData": "500"
  },
  {

    "timestamp": 512,

    "recordType": "Expect",
    "recordData": "login:"
  },
  {

    "timestamp": 512,

    "recordType": "Received Buffer Contains",
    "recordData": ""
  },
  {

    "timestamp": 4636,
    "recordType": "Received Bytes",
    "recordData": "18"
  },
  {
    "timestamp": 4636,

    "recordType": "Received Buffer Contains",

    "recordData": "�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },
  {
    "timestamp": 10002,

    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {

    "timestamp": 10003,

    "recordType": "Disconnect",
    "recordData": null
  },
  {

    "timestamp": 10004,

    "recordType": "Failed",
    "recordData": "timeout waiting for data"
  }
]

[
  {
    "timestamp": 0,
    "recordType": "Start",
    "recordData": "Standalone"
  },
  {
    "timestamp": 0,
    "recordType": "Version",
    "recordData": "2000020"
  },
  {

    "timestamp": 0,
    "recordType": "Send/Expect Data",
    "recordData": "Timeout milliseconds: 10\nPause 500 milliseconds\nExpect: Welcome to Microsoft Telnet Service\nlogin:\nSend : X\nPause 500 milliseconds\nExpect: password:\nSend : Y\nPause 1000 milliseconds\nSend : serialsend /baudrate 9600 /devnum 24 y\n"
  },
  {
    "timestamp": 15,

    "recordType": "Connection",
    "recordData": "192.168.1.2:23"
  },
  {

    "timestamp": 15,

    "recordType": "Pause",
    "recordData": "500"
  },
  {

    "timestamp": 517,
    "recordType": "Expect",
    "recordData": "Welcome to Microsoft Telnet Service\nlogin:"
  },
  {
    "timestamp": 517,

    "recordType": "Received Buffer Contains",
    "recordData": ""
  },
  {

    "timestamp": 4701,
    "recordType": "Received Bytes",
    "recordData": "18"
  },
  {
    "timestamp": 4701,

    "recordType": "Received Buffer Contains",

    "recordData": "�\u0001�\u0003��'��\u001f��\u0000�\u0000"
  },
  {
    "timestamp": 10004,

    "recordType": "Exception",
    "recordData": "timeout waiting for data"
  },
  {
    "timestamp": 10005,
    "recordType": "Disconnect",
    "recordData": null
  },
  {

    "timestamp": 10006,

[David]

Spent some more time looking at this this evening.  I am wondering if the 21 bytes are the Windows telnet server sending NVT commands  (see Microsoft - The TELNET Protocol).

Here is what I see trying to connect to a Windows 7 telnet server

Interpreting the \uffff as 255, \ufffd as 253, etc...  this appears to be a small handful of IAC do and IAC will commands.  What is probably needed is a response to them, which is also probably being provided automatically by the telnet clients before the login prompt is shown.

[Youssef Wagieh]

Well, that's beyond my head to be honest.. I've successfully made it work using an app called ScriptKitty (SSH instead of Telnet) but it has a bug in its widget system, it always sends the first script/command created so I can't use it to send multiple commands from widgets. Anyway, I'll keep trying with Send/Expect, and if I manage to send the expected responses first before the login, I'll let you know. Thanks a bunch for your support man! :)

[Michael Magrath]

Bit of an old topic but if anyone comes across it, the solution to log into a Windows Telnet server is to pass some binary switches before the 'login:' expect.

You will want to send 2 strings;

1.

\xff\xfc\x25

2.

\xff\xfd\x01\xff\xfd\x03\xff\xfc\x27\xff\xfb\x1f\xff\xfa\x1f\x00\x00\x00\x00\xff\xf0\xff\xfb\x1f\xff\xfb\x00\xff\xfd\x00

As David surmised, these strings set up the terminal options for the telnet session. It appears to be built into telnet clients but no so with Send/Expect. Once the Windows server receives these settings it will send the login: prompt which you can pick up with and Expect.

Still working out how to actually send the server commands though.

  2

M

[David]

On Sunday, September 11, 2016 at 11:41:38 PM UTC-7, Michael Magrath wrote:

Bit of an old topic but if anyone comes across it, the solution to log into a Windows Telnet server is to pass some binary switches before the 'login:' expect.

You will want to send 2 strings;

1.

\xff\xfc\x25

2.

\xff\xfd\x01\xff\xfd\x03\xff\xfc\x27\xff\xfb\x1f\xff\xfa\x1f\x00\x00\x00\x00\xff\xf0\xff\xfb\x1f\xff\xfb\x00\xff\xfd\x00

Hello Michael.

Thank you!  That is handy information.   A couple of questions:

1) How do you think that Send/Expect could make that easier, while still remaining a generic tool? Perhaps add something like a "Initialize Telnet Connection" canned send type?

2) Is this server string platform independent?  O/S, architecture, etc...

[Michael Magrath]

Hi David,

Maybe a 'Telnet' check box option in the profile setting that transparently prepends the terminal setting strings to the profile that will get you to the authentication prompt.

I've only tested it against Windows Server 2003 but the strings are based on standard RCFs and should be generic. Maybe not every telnet server would need them but every server should at least understand and respond to them.

There are two more additional strings required before you can send commands to the telnet server.

1. Tells the server you will be sending the terminal type

\xff\xfb\x18

2. Tells the server you are using an ANSI terminal

\xff\xfa\x18\x00\x41\x4e\x53\x49\xff\xf0

That gets you to a command prompt that you can pick up with Expect and then start sending commands as normal.