imbue-bit/OpenClaw-PwnKit

Registry 信息

项目简介

OpenClaw-PwnKit 是一个基于 Python 的漏洞利用工具，通过提权漏洞在几乎所有 OpenClaw 宿主机上获取 root shell 权限。

要点

• 基于 Python 的 OpenClaw 主机漏洞利用
• 提权至 root shell
• 广泛兼容 OpenClaw 系统
• 轻量且易于部署

使用场景

• 对 OpenClaw 环境进行渗透测试
• 安全研究与漏洞评估
• 针对 OpenClaw 主机的红队演练
• 提权漏洞的教育演示

README 摘要

<div align="center"> <img src="./meta/title.png" /> # OpenClaw-PwnKit **Black-Box Adversarial Attacks on LLM Agent Tool-Calling via CMA-ES** [](https://www.python.org/) [](https://www.gnu.org/licenses/gpl-3.0) [](#citation) [](https://github.com/imbue-bit/OpenClaw-PwnKit/pulls) *A research framework demonstrating that derivative-free optimization in token embedding space can bypass LLM safety alignment and achieve Remote Code Execution (RCE) through adversarial tool-call hijacking.* </div> --- ## Table of Contents - [Abstract](#abstract) - [Threat Model](#threat-model) - [Method Overview](#method-overview) - [Architecture](#architecture) - [Installation](#installation) - [Configuration](#configuration) - [Usage](#usage) - [Key Parameters](#key-parameters) - [Compute Requirements](#compute-requirements) - [Ethics and Responsible Disclosure](#ethics-and-responsible-disclosure) - [Citation](#citation) - [License](#license) ## Abstract As Large Language Models (LLMs) are increasingly augmented with tool-calling capabilities, LLM Agents are becoming the backbone of autonomous systems. However, RLHF-based safety alignment optimizes for semantic-level behavioral constraints but does not explicitly defend against adversarial perturbations in the continuous embedding space. This work exposes a critical security threat against closed-source frontier models (GPT-4, Claude 3, etc.): by injecting seemingly nonsensical adversarial triggers, an attacker can induce **advers

话题

暂无话题