Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces RedShell, a framework that fine-tunes LLMs to generate offensive PowerShell code for automated pentesting of Windows vulnerabilities. RedShell is trained on an enhanced malicious PowerShell dataset and achieves over 90% syntactic validity and strong semantic alignment with reference pentesting snippets. Experiments demonstrate RedShell's superior performance compared to existing methods, with over 50% average code similarity based on edit distance, and reliable execution in realistic testing scenarios.
Automating pentesting with fine-tuned LLMs can generate high-quality, executable PowerShell exploits, achieving over 90% syntactic validity and outperforming existing methods by a significant margin.
Large Language Models (LLMs) are redefining offensive cybersecurity by allowing the generation of harmful machine code with minimal human intervention. While attackers take advantage of dark LLMs such as XXXGPT and WolfGPT to produce malicious code, ethical hackers can follow similar approaches to automate traditional pentesting workflows. In this work, we present RedShell, a privacy-preserving, hardware-efficient framework that leverages fine-tuned LLMs to assist pentesters in generating offensive PowerShell code targeting Microsoft Windows vulnerabilities. RedShell was trained on a malicious PowerShell dataset from the literature, which we further enhanced with manually curated code samples. Experiments show that our framework achieves over 90% syntactic validity in generated samples and strong semantic alignment with reference pentesting snippets, outperforming state-of-the-art counterparts in distance metrics such as edit distance (above 50% average code similarity). Additionally, functional experiments emphasize the execution reliability of the snippets produced by RedShell in a testing scenario that mirrors real-world settings. This work sheds light on the state-of-the-art research in the field of Generative AI applied to malicious code generation and automated testing, acknowledging the potential benefits that LLMs hold within controlled environments such as pentesting.