The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication" vulnerability.
No PoCs from references.
- https://github.com/ARPSyndicate/cve-scores
- https://github.com/Cruxer8Mech/Idk
- https://github.com/ycdxsb/WindowsPrivilegeEscalation