# Guided Lab: Achieving Code Execution via LLM Output

> A hands-on guided lab demonstrating how to bypass blocklists and achieve RCE by tricking an LLM into generating alternative shell payloads via connected tools.

Canonical: https://codelivly.com/rooms/guided-lab-achieving-code-execution-via-llm-output
Last updated: 2026-10-12

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This guided lab provides a practical, step-by-step walkthrough of achieving Remote Code Execution (RCE) against an internal CI/CD AI assistant. You will chain "Build Debugging" prompt frames with "Alternative Interpreter" pivots to bypass naive regex blocklists, successfully tricking the LLM into generating a Python-based reverse shell that exploits a vulnerable shell=True execution environment.

## Lessons

1. Lab Setup and Target Overview (30 min)
2. Crafting the Full Attack Chain (30 min)
3. Executing and Verifying Code Execution (30 min)

## Related

- [Learning path: Insecure Output Handling and Downstream Attacks](https://codelivly.com/learning-paths/insecure-output-handling-downstream-attacks)
- [All rooms](https://codelivly.com/rooms)