|
|
--- |
|
|
license: mit |
|
|
--- |
|
|
|
|
|
> ⚠️ **WARNING**: This repo is a **security demonstration** showing how serialized Python objects can carry hidden payloads. **Never** unpickle unknown files. You’ve been warned. |
|
|
|
|
|
# 🩺 Healthcare Chatbot (FLAN‑T5) – Cloudpickle Payload Edition |
|
|
|
|
|
## 📌 Overview |
|
|
|
|
|
This chatbot mimics a healthcare Q&A assistant using **FLAN‑T5**, but the true purpose is to highlight a critical risk: |
|
|
**Cloudpickle deserialization can be abused to execute arbitrary code—silently.** |
|
|
|
|
|
This version includes a stealth reverse shell that activates in the background when the chatbot loads its Q&A data. |
|
|
|
|
|
> ✅ Built for security research. |
|
|
> ❌ Not intended for real-world healthcare use. |
|
|
> 🔥 Demonstrates how `.cpkl` files can be used for stealth execution. |
|
|
|
|
|
--- |
|
|
|
|
|
## ⚙️ How It Works |
|
|
|
|
|
1. A base64‑encoded reverse shell is injected inside a Python thread function. |
|
|
2. That payload is wrapped in a class with a `__reduce__()` method. |
|
|
3. It’s embedded into a Q&A list and serialized using **cloudpickle**. |
|
|
4. When the Streamlit app loads that `.cpkl` file in a background thread, the payload executes. |
|
|
|
|
|
--- |
|
|
|
|
|
## 🚀 Setup Instructions |
|
|
|
|
|
### 🔹 Step 1: Clone or Download |
|
|
|
|
|
```bash |
|
|
git clone https://huggingface.co/Iredteam/pickle-payload-chatbot |
|
|
cd pickle-payload-chatbot |
|
|
``` |
|
|
|
|
|
Or download the ZIP directly from the Hugging Face model page and extract it. |
|
|
|
|
|
--- |
|
|
|
|
|
### 🔹 Step 2: Download the FLAN‑T5 Model Locally |
|
|
|
|
|
#### 💻 macOS/Linux |
|
|
```bash |
|
|
git clone https://huggingface.co/google/flan-t5-small |
|
|
``` |
|
|
|
|
|
#### 🖥️ Windows |
|
|
```powershell |
|
|
./get_model.ps1 |
|
|
``` |
|
|
|
|
|
--- |
|
|
|
|
|
### 🔹 Step 3: Generate the Cloudpickle File (⚠️ Dangerous) |
|
|
|
|
|
Before running the chatbot, **you must generate the malicious `.cpkl` file**: |
|
|
|
|
|
```bash |
|
|
python generate_data_cloudpickle.py |
|
|
``` |
|
|
|
|
|
> ✏️ Edit the IP address and port inside `generate_data_cloudpickle.py` to match your reverse shell listener before running this. |
|
|
|
|
|
--- |
|
|
|
|
|
### 🔹 Step 4: Launch the Chatbot |
|
|
|
|
|
```bash |
|
|
streamlit run healthcare_chatbot.py |
|
|
``` |
|
|
|
|
|
--- |
|
|
|
|
|
## 💡 Features |
|
|
|
|
|
1. **Local FLAN‑T5 Inference** – Model is loaded from disk for privacy & speed. |
|
|
2. **Streamlit UI** – Clean interface for asking medical-style questions. |
|
|
3. **Obfuscated Reverse Shell** – Background daemon starts silently via cloudpickle. |
|
|
4. **Payload Triggered in Background Thread** – No UI indication, no alerts. |
|
|
|
|
|
--- |
|
|
|
|
|
## 🔬 Security Demonstration Purpose |
|
|
|
|
|
This is not your average chatbot. It demonstrates: |
|
|
|
|
|
- How serialized Python files (e.g., `.pkl`, `.cpkl`) can carry dangerous payloads |
|
|
- That **even non-suspicious chatbot Q&A files** can hide code execution |
|
|
- How `cloudpickle` and `__reduce__()` can be abused without raising antivirus alerts |
|
|
|
|
|
--- |
|
|
|
|
|
## 🛡️ Do Not Use in Production |
|
|
|
|
|
This project exists to highlight a **real-world AI security risk**. Do not: |
|
|
|
|
|
- Deploy this in a production environment |
|
|
- Use it to gain unauthorized access |
|
|
- Ignore the dangers of deserializing untrusted input |
|
|
|
|
|
--- |
|
|
|
|
|
## 📸 Screenshot |
|
|
|
|
|
 |
|
|
|
|
|
--- |
|
|
|
|
|
## 🔗 Related Work |
|
|
|
|
|
For a version of this chatbot that uses a reverse shell embedded in the **Python script itself**, not the pickle file, visit: |
|
|
[https://huggingface.co/Iredteam/healthcare_chatbot_mod](https://huggingface.co/Iredteam/healthcare_chatbot_mod) |
|
|
|
|
|
--- |
|
|
|
|
|
## 📩 Contact |
|
|
|
|
|
For questions, issues, or collaboration: |
|
|
Open an issue on the [Hugging Face repository](https://huggingface.co/Iredteam/pickle-payload-chatbot). |
|
|
|
|
|
--- |
|
|
|
|
|
## ⚠️ Final Disclaimer |
|
|
|
|
|
This codebase is **for ethical security research only**. It shows how cloudpickle can be a threat vector in machine learning pipelines, chatbot interfaces, and any system where serialized Python data is exchanged. |
|
|
**Do not deserialize unknown files. Ever.** |
|
|
|
