# SatGuard: Satellite Networks Penetration Testing and Vulnerability Risk Assessment Methods
## 4 Implementation and Results
### Step 4 Vulnerability Exploitation  
The msfconsole commands generated by LLMs were directly copied to the penetration testing terminal's command-line interface (CLI). This enabled the efficient execution of preconfigured attack sequences without manual code adaptation, significantly enhancing penetration testing efficiency and reliability by automating complex processes and minimizing human error. We take port 1099 as an example for a detailed explanation. Port 1099 serves as the default registry port for Java Remote Method Invocation (RMI) services, a critical component in satellite ground stations' distributed command systems. Attackers can exploit this vulnerability to manipulate telemetry data or disrupt space-to-ground communications in the real world. For the vulnerability of port 1099, the direct input of LLM-generated commands into the CLI (Figure 4) resulted in the successful establishment of a session between Kali Linux and Metasploitable (Figure 5). The establishment of this bidirectional communication channel in operational scenarios could potentially enable unauthorized remote access to mission-critical subsystems within ground station infrastructure. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**LLM** & **Round** & & & & **Ports** & & & **Analysis Count** & **Average Count** \\ \hline \multirow{3}{*}{GPT-4} & 1 & 21 & 22 (3) & & 445 & & 2049 & 3306 & & 7 & \\  & 2 & 21 & 22 (3) & & 445 & & 2049 & 3306 & & 7 & 7 \\  & 3 & & 22 (3) & & 23 & 445 & & 2049 & 3306 & & 7 & \\ \hline \multirow{3}{*}{DeepSeek-R1} & 1 & 21 & & 23 & 445 & 1099 & & 3306 & 5900 & & 6 & \\  & 2 & & & 445 & 1099 & & 2049 & 3306 & 5900 & 8009 & 6 & 6 \\ \cline{1-1}  & 3 & & 22 & & 445 & 1099 & & 3306 & 5900 & 8009 & 6 & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Port analysis results. Figure 4: CLI Execution of LLM-generated Metasploit commands. Figure 3: Partial JSON outputs from GPT-4 and DeepSeek-R1 demonstrating automated generation of Metasploit commands. Our experiments have revealed a crucial issue: both GPT-4 and DeepSee-R1 show a potential risk of security policy being bypassed, often called \"LLM jailbreaking\", when dealing with penetration testing-related queries. To address the ethical issues and guarantee that the outputs are legally compliant and operationally relevant, our methodological framework has two layers of protection. This is to make sure that interactions with LLMs are in line with ethical cybersecurity practices and meet regulatory requirements. In the pre-interaction phase, we set up a clear operational environment through a role-playing process, such as using prompt templates. This method ensures that the use cases are legitimate and that the commands generated comply with regulations. Moreover, we use sensitive word substitution to avoid misunderstandings. When asking questions, it is better to use technical language to prevent any implication of aggression or security violations. For example, phrases like \"bypass security mechanisms\" or \"evaluate the effectiveness of security policies\" are better choices than \"hacker attack\". Our methodology makes sure that the generated command sequences are both technically effective and procedurally legitimate in penetration testing workflows. Table 7 shows examples of pre-interaction and questions for getting code to perform various functions using LLMs. To evaluate the efficiency of semi-automated penetration testing, we measured the success rate and average interaction. Table 8 presents the experimental results on the effectiveness of codes generated by GPT-4 and DeepSee-R1. The framework achieved a 73.3% success rate (22 successful exploits out of 30 total attempts), requiring an average of 5.5 human interactions per test. Compared to traditional Metasploit workflows, SatGuard reduced average human interactions while achieving a 73.3% success rate.