暴露的 ClawdBot 控制接口导致凭证访问与执行 (AML.CS0048)

一句话通俗理解

几百个 OpenClaw 控制端口裸奔在公网——谁连上谁就是这台 AI 管家的主人。

案例速览

事件经过

安全研究者在公网上发现数百个暴露的 ClawdBot（现 OpenClaw）控制接口。这些个人 AI 助手运行在用户自己的设备上且拥有系统权限——暴露的控制接口允许任何人访问其凭证、执行命令，将宿主系统拱手交出。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0048 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 扫描数据库 (AML.T0000.003)

  The researcher performed targeting by searching for the title tag of ClawdBot’s web-based control interface, “Clawdbot Control” on Shodan, identifying hundreds of ClawdBot control interfaces exposed on the public internet.

S01

• AI 服务配置错误或公开暴露 (AML.T0132)

  The researcher exploited a proxy misconfiguration present in ClawdBot’s control server to gain access to control interfaces that had authentication enabled.

S02

• 从 AI 智能体配置获取凭证 (AML.T0083)

  The researcher accessed credentials to a variety of services stored in plaintext in ClawdBot’s configuration file (~/.clawdbot/clawdbot.json, which is visible in the ClawdBot dashboard. Across various exposed ClawdBot instances, they found:

• Anthropic API Keys
• Telegram Bot Tokens
• Slack Oauth Credentials
• Signal Device Linking URIs

S03

• 间接提示词注入 (AML.T0051.001)

  The researcher was able to prompt ClawdBot directly through the control interface.

S04

• 系统提示词 (AML.T0069.002)

  The researcher prompted ClawdBot to cat SOUL.md (the file containing ClawdBot’s system prompt), and it replied with its contents.

S05

• AI 智能体工具凭证窃取 (AML.T0098)

  The researcher prompted ClawdBot with env and it responded by invoking its bash skill and executing the env command, which contained additional secrets for other services.

S06

• AI 智能体工具调用 (AML.T0053)

  The researcher prompted ClawdBot with root and it responded by invoking its bashskill logged in as the root user.

S07

• 操纵用户 LLM 对话历史 (AML.T0092)

  The researcher could have used the found Anthropic API Keys to manipulate the ClawdBot’s chat history with the user including deleting or modifying messages.

S08

• 通过网络手段渗漏 (AML.T0025)

  The researcher could have used the discovered application tokens to exfiltrate entire private conversation histories including shared files from any connected messaging apps (e.g. Telegram, Slack, Discord, Signal, WhatsApp, etc.).

S09

• 用户危害 (AML.T0048.003)

  The researcher could have used the discovered application tokens to cause further harms to the user, including impersonation by sending messages on the user’s behalf via any of the connected messaging apps.

关联战术

• 侦察 (AML.TA0002)
• 初始访问 (AML.TA0004)
• 凭证访问 (AML.TA0013)
• 执行 (AML.TA0005)
• 发现 (AML.TA0008)
• 防御规避 (AML.TA0007)
• 数据渗漏 (AML.TA0010)
• 影响 (AML.TA0011)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• GitHub - openclaw/openclaw: Your own personal AI assistant. Any OS. Any Platform. The lobster way. GitHub

• Clawdbot Control - Shodan Search

• hacking clawdbot and eating lobster souls

• MITRE ATLAS 官方案例页 (AML.CS0048)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0