How to gain code execution on hundreds of millions of people and popular apps

Re:How to gain code execution on hundreds of millions of peo... by tomjakubowski on Friday February 28, 2025 @07:23PM (#43213915)

Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by gtirloni on Friday February 28, 2025 @09:03PM (#43214805)

So this friend escaped from the ephemeral container VM into the build host which happened to have a private SSH on it that allowed it to connect to a bastion host to... go back to the build host and debug a failed build that should be self-contained inside the container VM which they already had access in the first place by the means of, you know, running a build on it? Interesting.

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by TheDong on Friday February 28, 2025 @09:52PM (#43215204)

> probably against GitHub's ToS, but

Why would running code on a github action runner that's built to run code be against ToS?

If it was, I'm sure they'd ban the marketplace extensions that make it absolutely trivial to do this: https://github.com/marketplace/actions/debugging-with-ssh

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by pulkitsh1234 on Saturday March 01, 2025 @06:17AM (#43218200)

could have just used https://github.com/mxschmitt/action-tmate

[ Parent | on HN ]