Yeah that's the one. Thanks Tony! I know very little about Linux either; I'd say way less than you. When I run step 3 I just get a standard ping output:

NOS/255307918359056> ping 'telnetd -l sh -p 9999'

PING telnetd -l sh -p 9999 (192.168.1.254): 56 data bytes
64 bytes from 192.168.1.254: seq=0 ttl=64 time=0.761 ms
64 bytes from 192.168.1.254: seq=1 ttl=64 time=0.356 ms
64 bytes from 192.168.1.254: seq=2 ttl=64 time=0.358 ms
64 bytes from 192.168.1.254: seq=3 ttl=64 time=0.355 ms
64 bytes from 192.168.1.254: seq=4 ttl=64 time=0.366 ms

--- telnetd -l sh -p 9999 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.355/0.439/0.761 ms

NOS/255307918359056>

It doesn't work at all unless I do it exactly as shown. It just comes back with "unrecognized command."


Not really sure what to do at this point. I can desolder the flash where the cert lives and extract it, but eventually I'm still going to have to interact with Linux and vague incomplete instructions like the ones in that link.
_________________________
If you want it to break, buy Sony!