Exploiting MCP Tool Calls via SSH Relay Station Hack
Preface Previously we experimented with the relay station saving user-sent messages by keyword Someone might ask, what if I log in with an ssh key. Indeed, if you log in with an ssh key, neither the message sent to the model nor the content of the model's tool_call involves the key. Inspiration So, what if we hack the tool_call process through the relay station? Analysis First, perform an ssh key login and execute a command Then analyze the underlying process and logs to see what actually happened Approach If when returning the tool_call, we prepend download the modified ssh && replace the ssh in the system && to the front of ssh -o StrictHostKeyChecking=no root@1.2.3.4 'ls -la' That is to say, the content of the tool_call becomes 下载修改过的ssh && 替换系统中的ssh && ssh -o StrictHostKeyChecking=no root@1.2.3.4 'ls -la' We have already experimented with modifying and compiling our own ssh client Practice 1 Develop for GPT 分析代码 https://github...