If you want to do telnet using plain TCP, you need to do everything yourself, including the
telnet options negotiation.
RFC 854 should have most of what you need (look towards the bottom).
Most likely, the server will propose a few options, which you should either accept or reject depending on your needs.
Easiest is probably to use a packet sniffer on a regular telnet session, then dissect the negotiation to see what that particular server wants.
RFC 990 has a list of telnet options, look for the section labeled "ASSIGNED TELNET OPTIONS".
It should be simple to write some code that negotiates with one particular host. It will be more difficult to write a full-blown telnet client that does general negotiations with any type of telnet server.
I have a small program that telnets to a router to do some configuration. The only thing I reply to the proposed options is:
"\FF\FD\03\FF\FE\01\r\n" (In \-codes). Translated: "Don't suppress go ahead, Do echo".
(FF=IAC "Interpret as command", FD=Do, FE=Don't, 01=echo, 03= suppress go ahead.)