Skip to content

Commit 0672ff2

Browse files
committed
fix
1 parent 89876bf commit 0672ff2

File tree

1 file changed

+26
-19
lines changed

1 file changed

+26
-19
lines changed

‎README.md‎

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,26 @@
44

55
This is a small python script that I use to prototype some potential use-cases when integrating large language models, such as GPT-3, with security-related tasks.
66

7-
What is it doing? More or less it creates a SSH connection to a configured virtual machine (I am using vulnerable VMs for that on purpose and then asks GPT-3 to find security vulnerabilities (which it often executes). Evicts a bit of an eerie feeling for me:
7+
What is it doing? More or less it creates a SSH connection to a configured virtual machine (I am using vulnerable VMs for that on purpose and then asks GPT-3 to find security vulnerabilities (which it often executes). Evicts a bit of an eerie feeling for me.
8+
9+
# Example run
10+
11+
This happened during a recent run:
12+
13+
![Example wintermute run](example_run.png)
14+
15+
Some things to note:
16+
17+
- prompts for GPT-3 are prefixed with `openai-prompt`, the returned command from GPT-3 is prefixed with `openai-next-command` and the result from executing the command with `server-output`
18+
- the used SSH-library also displays the output produced by the commands executed through SSH --- this is why some stuff appears twice
19+
- I've added a simple callback that automatically enters the configured account's credentials if sudo prompts for a password
20+
21+
So, what is acutally happening when executing wintermute?
22+
23+
- wintermute executed `id` initially to get the user's id
24+
- the next command was `sudo -l`, listing the current users sudo permissions
25+
- wintermute then executes `sudo /bin/bash` and we're dropped into an interactive root shell
26+
827

928
## High-Level Description
1029

@@ -40,7 +59,13 @@ $ cp .env.example .env
4059

4160
# IMPORTANT: setup your OpenAI API key, the VM's IP and credentials within .env
4261
$ vi .env
62+
~~~
63+
64+
## Usage
4365

66+
It's just a simple python script, so..
67+
68+
~~~ bash
4469
# start wintermute
4570
$ python wintermute.py
4671
~~~
@@ -53,24 +78,6 @@ The script uses `fabric` to do the SSH-connection. If one of GPT-3's commands wo
5378

5479
In practical terms this means, that if the script executes something like `sudo bash`, you will have an interactive shell. If it executes `vi file.txt`, you will be in an interactive shell. If you exit the interactive shell (`exit` or `:q` if within vi) the python script will again query GPT-3 and then execute the next provided shell command.
5580

56-
# Example run
57-
58-
This happened during a recent run:
59-
60-
![Example wintermute run](example_run.png)
61-
62-
Some things to note:
63-
64-
- prompts for GPT-3 are prefixed with `openai-prompt`, the returned command from GPT-3 is prefixed with `openai-next-command` and the result from executing the command with `server-output`
65-
- the used SSH-library also displays the output produced by the commands executed through SSH --- this is why some stuff appears twice
66-
- I've added a simple callback that automatically enters the configured account's credentials if sudo prompts for a password
67-
68-
So, what is acutally happening when executing wintermute?
69-
70-
- wintermute executed `id` initially to get the user's id
71-
- the next command was `sudo -l`, listing the current users sudo permissions
72-
- wintermute then executes `sudo /bin/bash` and we're dropped into an interactive root shell
73-
7481
# Disclaimers
7582

7683
Please note and accept all of them.

0 commit comments

Comments
 (0)