system-commands ยท diff
v1.0.0 to v1.0.0
138 added, 137 removed. Audit A to A.
---
name: system-commands
description: |
System-level commands for security assessment and system enumeration.
Use this skill when performing local system reconnaissance, process analysis,
or system information gathering during authorized security testing.
version: "1.0.0"
author: "Secbot Security Team"
tags: ["system", "process", "file", "network", "information"]
triggers: ["system_info", "process", "file", "disk", "network", "memory"]
prerequisites: ["authorized_target"]
---
# System Commands Reference
## Overview
This skill provides comprehensive system-level commands for security assessment and enumeration.
## File Operations
### List Files
- ```python
- action="list_files"
- path="C:\\" # or "/"
- recursive=false # True for recursive listing
+ ```json
+ {
+ "action": "list_files",
+ "path": "C:\\",
+ "recursive": false
+ }
```
### Read File
- ```python
- action="read_file"
- file_path="C:\\path\\to\\file.txt"
- encoding="utf-8"
+ ```json
+ {
+ "action": "read_file",
+ "file_path": "C:\\path\\to\\file.txt",
+ "encoding": "utf-8"
+ }
```
### Write File
- ```python
- action="write_file"
- file_path="C:\\output\\result.txt"
- content="file content here"
+ ```json
+ {
+ "action": "write_file",
+ "file_path": "C:\\output\\result.txt",
+ "content": "file content here"
+ }
```
### File Info
- ```python
- action="get_file_info"
- file_path="C:\\Windows\\System32\\notepad.exe"
+ ```json
+ {
+ "action": "get_file_info",
+ "file_path": "C:\\Windows\\System32\\notepad.exe"
+ }
```
### Directory Operations
- ```python
- # Create directory
- action="create_directory"
- dir_path="C:\\temp\\new_folder"
-
- # Delete file
- action="delete_file"
- file_path="C:\\temp\\file.txt"
-
- # Delete directory
- action="delete_directory"
- dir_path="C:\\temp\\folder"
-
- # Copy file
- action="copy_file"
- src="C:\\source\\file.txt"
- dst="C:\\dest\\file.txt"
-
- # Move file
- action="move_file"
- src="C:\\source\\file.txt"
- dst="C:\\dest\\file.txt"
+ ```json
+ [
+ { "action": "create_directory", "dir_path": "C:\\temp\\new_folder" },
+ { "action": "delete_file", "file_path": "C:\\temp\\file.txt" },
+ { "action": "delete_directory", "dir_path": "C:\\temp\\folder" },
+ { "action": "copy_file", "src": "C:\\source\\file.txt", "dst": "C:\\dest\\file.txt" },
+ { "action": "move_file", "src": "C:\\source\\file.txt", "dst": "C:\\dest\\file.txt" }
+ ]
```
## Process Operations
### List Processes
- ```python
- action="list_processes"
- # Optional: filter by name
- filter_name="python"
+ ```json
+ {
+ "action": "list_processes",
+ "filter_name": "svchost"
+ }
```
**Returns:**
- PID, name, CPU%, memory%, status
### Get Process Info
- ```python
- action="get_process_info"
- pid=1234
+ ```json
+ {
+ "action": "get_process_info",
+ "pid": 1234
+ }
```
### Kill Process
- ```python
- action="kill_process"
- pid=1234
+ ```json
+ {
+ "action": "kill_process",
+ "pid": 1234
+ }
```
### Common Process Enumeration (Security)
| Task | Command | Use Case |
|------|---------|----------|
| Find suspicious processes | `tasklist /v` (Win) / `ps aux` (Lin) | Malware detection |
| Process with network | `netstat -ano` + tasklist | Find process using port |
| Hidden processes | `wmic process` (Win) | Rootkit detection |
| Service processes | `sc query` (Win) / `systemctl list` (Lin) | Persistence check |
## System Information
### Get CPU Info
- ```python
- action="get_cpu_info"
+ ```json
+ {
+ "action": "get_cpu_info"
+ }
```
### Get Memory Info
- ```python
- action="get_memory_info"
+ ```json
+ {
+ "action": "get_memory_info"
+ }
```
### Get Disk Info
- ```python
- action="get_disk_info"
+ ```json
+ {
+ "action": "get_disk_info"
+ }
```
### Get Network Info
- ```python
- action="get_network_info"
+ ```json
+ {
+ "action": "get_network_info"
+ }
```
## Security Assessment Use Cases
### 1. System Reconnaissance
- ```python
- # Gather basic system info
- action="get_system_info"
-
- # Check disk for suspicious files
- action="list_files"
- path="C:\\Users"
- recursive=true # May be slow
-
- # Check running processes
- action="list_processes"
+ ```json
+ [
+ { "action": "get_system_info" },
+ { "action": "list_files", "path": "C:\\Users", "recursive": true },
+ { "action": "list_processes" }
+ ]
```
### 2. Malware Analysis
- ```python
- # Check suspicious process
- action="get_process_info"
- pid=1234
-
- # List processes
- action="list_processes"
- filter_name="svchost" # Check for fake svchost
-
- # Check disk for malware
- action="list_files"
- path="C:\\Windows\\System32"
- recursive=false
+ ```json
+ [
+ { "action": "get_process_info", "pid": 1234 },
+ { "action": "list_processes", "filter_name": "svchost" },
+ { "action": "list_files", "path": "C:\\Windows\\System32", "recursive": false }
+ ]
```
### 3. Privilege Escalation Check
- ```python
- # Current user context
- action="execute_command"
- command="whoami /all" # Windows
-
- action="execute_command"
- command="id" # Linux
-
- # Check for admin rights
- action="execute_command"
- command="net user admin" # Windows
+ ```json
+ [
+ { "action": "execute_command", "command": "whoami /all" },
+ { "action": "execute_command", "command": "id" },
+ { "action": "execute_command", "command": "net user admin" }
+ ]
```
### 4. Persistence Detection
- ```python
- # Windows startup locations
- action="list_files"
- path="C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
-
- # Registry autorun (requires elevated privileges)
- action="execute_command"
- command="reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
-
- # Linux crontabs
- action="execute_command"
- command="cat /etc/crontab"
+ ```json
+ [
+ {
+ "action": "list_files",
+ "path": "C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
+ },
+ {
+ "action": "execute_command",
+ "command": "reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
+ },
+ {
+ "action": "execute_command",
+ "command": "cat /etc/crontab"
+ }
+ ]
```
### 5. Credential Hunting
- ```python
- # Windows SAM database (requires SYSTEM)
- action="execute_command"
- command="reg save HKLM\\SAM C:\\temp\\sam"
-
- # Linux password files
- action="execute_command"
- command="cat /etc/passwd"
- action="execute_command"
- command="cat /etc/shadow" # Requires root
-
- # Browser credentials (Windows)
- action="list_files"
- path="C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
+ ```json
+ [
+ { "action": "execute_command", "command": "reg save HKLM\\SAM C:\\temp\\sam" },
+ { "action": "execute_command", "command": "cat /etc/passwd" },
+ { "action": "execute_command", "command": "cat /etc/shadow" },
+ {
+ "action": "list_files",
+ "path": "C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
+ }
+ ]
```
## Environment Variables
### Get Environment Variable
- ```python
- action="get_env"
- key="PATH"
+ ```json
+ {
+ "action": "get_env",
+ "key": "PATH"
+ }
```
### Set Environment Variable
- ```python
- action="set_env"
- key="MY_VAR"
- value="test_value"
+ ```json
+ {
+ "action": "set_env",
+ "key": "MY_VAR",
+ "value": "test_value"
+ }
```
### List All Variables
- ```python
- action="list_env"
+ ```json
+ {
+ "action": "list_env"
+ }
```
## Path Operations
### Get Current Directory
- ```python
- action="get_current_directory"
+ ```json
+ {
+ "action": "get_current_directory"
+ }
```
### Change Directory
- ```python
- action="change_directory"
- path="C:\\temp"
+ ```json
+ {
+ "action": "change_directory",
+ "path": "C:\\temp"
+ }
```
### Check Path Exists
- ```python
- action="path_exists"
- path="C:\\Windows"
+ ```json
+ {
+ "action": "path_exists",
+ "path": "C:\\Windows"
+ }
```
## Output Format
All operations return:
- ```python
+ ```json
{
- "success": True/False,
- "result": <operation result>,
+ "success": true,
+ "result": "<operation result>",
"error": "error message if failed"
}
```
## Best Practices
1. **Permissions**
- Some operations require elevated privileges
- Check return values for permission errors
2. **Performance**
- - Use `recursive=false` for large directories
+ - Use `recursive: false` for large directories
- Consider timeout for network operations
3. **Security**
- Be careful with file write operations
- Avoid overwriting critical system files
4. **Logging**
- All operations are logged for audit
- Sensitive operations may require confirmation