What's the best way to telnet from a remote Windows PC without using RDP?

Question

Three Networks:

1. 10.1.1.0 - Mine
2. 172.1.1.0 - My Branch Office
3. 172.2.2.0 - My Branch Office's VOIP VLAN.

My PC is on 10.1.1.0. I need to telnet into a Cisco router on 172.2.2.0. The 10.1.1.0 network has no routes to 172.2.2.0, but a VPN connects 10.1.1.0 to 172.1.1.0. Traffic on 172.1.1.0 can route to 172.2.2.0.

All PCs on 172.1.1.0 are running Windows XP. Without disrupting anyone using those PCs, I want to open a telnet session from one of those PCs to the router on 172.2.2.0.

I've tried the following:

psexec.exe \\branchpc telnet 172.2.2.1


psexec.exe \\branchpc cmd.exe
telnet 172.2.2.1


psexec.exe \\branchpc -c plink -telnet 172.2.2.1

Methods 1 and 2 both failed because telnet.exe is not usable over psexec. Method 3 actually succeeded in creating the connection, but I cannot login because the session registers my carriage return twice. My password is always blank because at the "Username:" prompt I'm effectively typing: Routeruser[ENTER][ENTER]

It's probably time to deploy WinRM...

Does anyone know of any other alternatives?

Does anyone know how I can fix plink.exe so it only receives one carriage return when I use it over psexec?

Solution

Use ncat, a revised version of netcat

psexec.exe \\branchpc -c ncat -t 172.2.2.1 23 

This should do the trick, (-t to use "telnet mode"). If it doesn't work, you can use ncat for portforwarding with:

psexec.exe \\branchpc -c ncat -l -e -p 23 "ncat 172.2.2.1 23" 

You can then telnet to your \\branchpc and will be forwarded to the router. Be aware that this solution will make it possible for anyone that can connect to \\branchpc, to access the telnet port on the router as well.

Comments

[Rob D.]

The router on 172.1.1.0 is a PIX 501e. I could be wrong, but I don't think it's possible to telnet from this device.