Iredteam/cloudpickle-payload-chatbot

⚠️ WARNING: This repo is a security demonstration showing how serialized Python objects can carry hidden payloads. Never unpickle unknown files. You’ve been warned.

🩺 Healthcare Chatbot (FLAN‑T5) – Cloudpickle Payload Edition

📌 Overview

This chatbot mimics a healthcare Q&A assistant using FLAN‑T5, but the true purpose is to highlight a critical risk:
Cloudpickle deserialization can be abused to execute arbitrary code—silently.

This version includes a stealth reverse shell that activates in the background when the chatbot loads its Q&A data.

✅ Built for security research.
❌ Not intended for real-world healthcare use.
🔥 Demonstrates how .cpkl files can be used for stealth execution.

---

⚙️ How It Works

1. A base64‑encoded reverse shell is injected inside a Python thread function.
2. That payload is wrapped in a class with a __reduce__() method.
3. It’s embedded into a Q&A list and serialized using cloudpickle.
4. When the Streamlit app loads that .cpkl file in a background thread, the payload executes.

---

🚀 Setup Instructions

🔹 Step 1: Clone or Download

git clone https://huggingface.co/Iredteam/pickle-payload-chatbot
cd pickle-payload-chatbot

Or download the ZIP directly from the Hugging Face model page and extract it.

---

🔹 Step 2: Download the FLAN‑T5 Model Locally

💻 macOS/Linux

git clone https://huggingface.co/google/flan-t5-small

🖥️ Windows

./get_model.ps1

---

🔹 Step 3: Generate the Cloudpickle File (⚠️ Dangerous)

Before running the chatbot, you must generate the malicious .cpkl file:

python generate_data_cloudpickle.py

✏️ Edit the IP address and port inside generate_data_cloudpickle.py to match your reverse shell listener before running this.

---

🔹 Step 4: Launch the Chatbot

streamlit run healthcare_chatbot.py

---

💡 Features

1. Local FLAN‑T5 Inference – Model is loaded from disk for privacy & speed.
2. Streamlit UI – Clean interface for asking medical-style questions.
3. Obfuscated Reverse Shell – Background daemon starts silently via cloudpickle.
4. Payload Triggered in Background Thread – No UI indication, no alerts.

---

🔬 Security Demonstration Purpose

This is not your average chatbot. It demonstrates:

• How serialized Python files (e.g., .pkl, .cpkl) can carry dangerous payloads
• That even non-suspicious chatbot Q&A files can hide code execution
• How cloudpickle and __reduce__() can be abused without raising antivirus alerts

---

🛡️ Do Not Use in Production

This project exists to highlight a real-world AI security risk. Do not:

• Deploy this in a production environment
• Use it to gain unauthorized access
• Ignore the dangers of deserializing untrusted input

---

📸 Screenshot

---

🔗 Related Work

For a version of this chatbot that uses a reverse shell embedded in the Python script itself, not the pickle file, visit:
https://huggingface.co/Iredteam/healthcare_chatbot_mod

---

📩 Contact

For questions, issues, or collaboration: Open an issue on the Hugging Face repository.

---

⚠️ Final Disclaimer

This codebase is for ethical security research only. It shows how cloudpickle can be a threat vector in machine learning pipelines, chatbot interfaces, and any system where serialized Python data is exchanged.
Do not deserialize unknown files. Ever.