PT0-001 · Question #66
A penetration tester ran the following Nmap scan on a computer nmap -sV 192.168.1.5. The organization said it had disabled Telnet from its environment. However, the results of the Nmap scan show…
The correct answer is A. The organization failed to disable Telnet. When port 23 shows as open despite an organization claiming Telnet was disabled, the most direct explanation is that the Telnet service was not successfully removed from the host.
Question
A penetration tester ran the following Nmap scan on a computer nmap -sV 192.168.1.5. The organization said it had disabled Telnet from its environment. However, the results of the Nmap scan show port 22 as closed and port 23 as open to SSH. Which of the following is the BEST explanation for what happened?
Options
- AThe organization failed to disable Telnet.
- BNmap results contain a false positive for port 23.
- CPort 22 was filtered.
- DThe service is running on a non-standard port.
How the community answered
(22 responses)- A73% (16)
- B5% (1)
- C5% (1)
- D18% (4)
Why each option
When port 23 shows as open despite an organization claiming Telnet was disabled, the most direct explanation is that the Telnet service was not successfully removed from the host.
Port 23 is the well-known registered port for Telnet, and its open status confirms the service is still running on the host. Nmap's -sV service version detection can misidentify a service based on banner responses, causing it to label an active Telnet port as SSH, but the open port state itself is accurate. This means the organization failed to properly disable Telnet despite their claim.
A false positive would mean port 23 is not actually open on the target, but Nmap's port state detection is reliable and the port is genuinely open - only the service label may be inaccurate, not the port's open state.
Nmap distinguishes between 'closed' meaning the host responded with a TCP RST and 'filtered' meaning no response or an ICMP unreachable was received, so port 22 being closed means SSH actively rejected the connection rather than being blocked by a firewall.
If SSH were intentionally relocated to port 23 as a non-standard port, that would still not explain why port 23 is open when the organization explicitly stated Telnet on that port was disabled.
Concept tested: Nmap service version detection and Telnet port verification
Source: https://nmap.org/book/man-version-detection.html
Topics
Community Discussion
No community discussion yet for this question.