Hell, Terrell could have accessed the current Enterprise vulnerable points once aboard the Reliant and spoon fed all the info to Khan.Khan knew basics of Starfleet technology from the technical manuals he read when picked up 15 years earlier. He knew where to target Enterprise.
I would say he had a working knowledge of ships and their systems, but not command-level knowledge as in the case of the prefix codes.
Khan wanted and planned his revenge aboard the Reliant before he altered course to intercept the Enterprise. (And Starfleet ships have full access to all fleet info as Spock had Reliant's prefix code in seconds.)