Towards Automated Pentesting with Large Language Models

TL;DR

This paper introduces RedShell, a framework using fine-tuned LLMs to automate PowerShell-based pentesting on Windows, achieving high validity and semantic accuracy in generated malicious code snippets.

Contribution

RedShell is a novel, privacy-preserving framework that enhances automated pentesting with fine-tuned LLMs, outperforming existing methods in code validity and similarity metrics.

Findings

RedShell achieves over 90% syntactic validity in generated code.

RedShell's code snippets show above 50% average similarity to reference samples.

Functional tests confirm reliable execution of generated pentesting scripts.

Abstract

Large Language Models (LLMs) are redefining offensive cybersecurity by allowing the generation of harmful machine code with minimal human intervention. While attackers take advantage of dark LLMs such as XXXGPT and WolfGPT to produce malicious code, ethical hackers can follow similar approaches to automate traditional pentesting workflows. In this work, we present RedShell, a privacy-preserving, hardware-efficient framework that leverages fine-tuned LLMs to assist pentesters in generating offensive PowerShell code targeting Microsoft Windows vulnerabilities. RedShell was trained on a malicious PowerShell dataset from the literature, which we further enhanced with manually curated code samples. Experiments show that our framework achieves over 90% syntactic validity in generated samples and strong semantic alignment with reference pentesting snippets, outperforming state-of-the-art counterparts in distance metrics such as edit distance (above 50% average code similarity). Additionally, functional experiments emphasize the execution reliability of the snippets produced by RedShell in a testing scenario that mirrors real-world settings. This work sheds light on the state-of-the-art research in the field of Generative AI applied to malicious code generation and automated testing, acknowledging the potential benefits that LLMs hold within controlled environments such as pentesting.