ShellNet Field Guide

Everything you need to go from first connect to first breach, and to keep other people out of your box.

01Connect

ShellNet is an SSH server. There is no client to download and no signup: your SSH key is your account.

$ ssh play@shellnet.lol

The name before the @ is your display name, so pick anything. The first time you connect, an account is created from your key. The next time, the same key brings you back to the same account.

No key yet? Make one, then connect:

$ ssh-keygen -t ed25519

02Getting around

It works like a real shell: every command is a program you can run from anywhere. A few are tools that take a subcommand, the way git commit does.

play@shellnet.lol:~ $ scan 192.168.1              # a command
play@shellnet.lol:~ $ threads rent 2              # a tool + subcommand
play@shellnet.lol:~ $ threads                     # a tool on its own shows its overview

Every command acts on the machine you're on. At home that's your box; after ssh or a breach it's that machine, and the same commands work there. The only thing that changes is whether you have root on it.

03The four things that matter

Threads: your compute

Every action that takes time runs on a thread: mining, defending, attacking, or just being connected. You start with 1 thread (a free 30-day rental). Your SSH connection occupies a thread while you're online, and long commands like mine and bruteforce run on it. More threads make attacks faster, defense stronger and mining more productive. Rent more with threads rent. Rentals expire, so power has to be renewed.

SHELL: your money

SHELL is the currency. You earn it by mining or by looting other machines, and you spend it on threads, IP rotation and guilds. Check it with balance. SHELL sitting on your machine can be stolen by anyone who breaches you.

IPs: where everything lives

Your own IP is on the first line of status. The world is deterministic: the same address always holds the same machine.

Logs: your fingerprints

Every hostile act (deep scan, attack, breach, escalation, theft) is written to the target's forensic log, tagged with your IP. Owners read their logs. Hiding your trail is a skill of its own (see Covering your tracks).

04Your first session

1. Root your own box. You don't start with root on yourself. Getting it is the tutorial, and it's permanent once done. It unlocks your defensive tools.

   ~ $ escalate
   Root Hardening: 3   Host Threads: 1   Estimated Time: 1h 30m

   It runs on the connection you start it from and holds it until root lands; Ctrl+C gives up. The more threads the machine has, the faster it goes, and you can't throw extra threads at it.
2. Find machines. A sweep of a range is silent and leaves no trace:

   ~ $ scan 192.168.1
     192.168.1.1        CPU
     192.168.1.3        CPU
     ...
     74 hosts alive of 256 swept.

3. Case a target. A deep scan shows the details, but it leaves a probe on the target's log:

   ~ $ scan 192.168.1.1
   Defense:         1 thread
   Root Hardening:  2
   Loot (approx):   ~101 SHELL

   Look for low defense and high loot.
4. Mine while you wait. Mining pays out per epoch (one day). Stay mining across the epoch boundary and the reward is credited automatically. Otherwise collect it later with claim.

   ~ $ mine
   Mining Rate: 1.67 SHELL/hour ... (Ctrl+C to stop)

5. Go for your first breach. See the next section.

05Breaching a machine

~ $ bruteforce 192.168.1.1        # optionally: bruteforce <ip> <threads>
Attack Threads: 1   Defense Threads: 1   Estimated Time: 3h 30m

Bruteforce holds your connection until it lands, and Ctrl+C aborts it. Time shrinks with the threads you commit and grows with the target's defense. A second SSH connection lets you keep playing while one attacks, but each connection needs a free thread.

When it lands you get a shell on the target as user. Your prompt now shows that machine, and every command acts on it, exactly as at home. The ones that matter most:

06Covering your tracks

• Jump chains. Like ssh -J: put -J hop1,hop2 first and the command goes you → hop1 → hop2 → target. The target logs only the last hop; each hop logs only the one before it, so a hunter has to breach every hop in turn to reach you. A hop is any machine you hold a key on (one you've backdoored, or whose owner authorized you), or one running a relay.

  ~ $ bruteforce -J 192.168.1.4,10.0.7.2 192.168.1.9

  Works with bruteforce, ssh, scan and chat <ip>, and lasts for that one command.
• Relays. proxy runs an open relay on the machine you're on, so anyone can use it as a hop without a key. It runs on that terminal until you Ctrl+C. The relay logs everyone who jumps through it.
• Clear logs. With root on a breached box, clear-logs removes every entry from your (effective) IP.
• Forge. With root, forge <ip> <type> plants a false log entry blaming someone else.
• Quiet recon. Sweep ranges, and deep-scan only what you mean to hit.

07Defending yourself

Everyone can be breached. Your job is to be slow to breach, quick to notice and hard to keep.

08Guilds

A guild is a persistent 172.16.x machine with a roster, a treasury and its own threads. Founding one costs 1000 SHELL.

~ $ guild create <name>         # found one
~ $ guild join <guild-ip>       # join one
~ $ guild                       # roster + status
~ $ guild chat                  # always-on guild chat

Leaders and officers can rent guild threads (guild rent), put them on standing defense (guild defend), run an always-on relay or chat (guild service), and promote or kick members. Members can pool threads into the guild box with threads lend <guild-ip> <n>.

09Numbers

10Command reference

-J hop1,hop2 goes first on bruteforce, ssh, scan and chat. root means you need root on the machine you're on.

Recon & attack

Cover your tracks root

Defense

Mining & SHELL

Tools

Everything else