Living Off The Pipeline: Defensive Research, Weaponized

### Overview In this Troopers conference talk, Franceu, VP of Security Research at Boost Security, demonstrates how CI/CD pipelines have evolved from theoretical attack surfaces into actively exploited initial access vectors. Highlighting real-world attacks where threat actors turned defensive CI/CD documentation and tools into offensive playbooks, Franceu showcases **Smoke Meat**, a new open-source red team post-exploitation framework designed specifically for build pipelines. Through live demonstrations on the custom 'Hulie' Capture The Flag (CTF) environment, he illustrates how an initial access vector on a public repository can escalate through private repositories and ultimately lead to cloud infrastructure takeover and persistent runner compromise.

### Key Topics - **Weaponization of CI/CD Defensive Research**: Threat actors exploiting unpatched pipeline vulnerabilities (e.g., in Ultralytics, Trivy, and npm/PyPI worms by groups like Team PCP) to exfiltrate pipeline secrets and compromise downstream packages. - **Common Pipeline Vulnerability Classes**: Analysis of 'pwn requests' (Living off the Pipeline / LotP), template and command injection, bot-mediated confused deputies, and non-ephemeral self-hosted runners. - **The Smoke Meat Framework**: Architecture of an open-source post-exploitation tool integrating the static analyzer Poutine as a library alongside the LotP catalog, featuring a terminal UI, C2 team server, and cross-platform memory-dumping implants. - **Cache Poisoning and OIDC Exploitation**: Chaining low-privilege workflow injection into cache poisoning to indirectly compromise sensitive release pipelines using short-lived OpenID Connect (OIDC) tokens. - **Self-Hosted Runner Persistence**: Techniques to outlive job execution on self-hosted runners by unsetting runner tracking variables, enabling persistent observation and access across subsequent scheduled jobs.

### Technical Details Franceu demonstrates multi-stage attacks across both ephemeral and self-hosted build runners: - **Recon & Command Injection**: Smoke Meat scans GitHub organizations, builds a graph index of workflows, jobs, and secrets, and automatically crafts context-aware payloads (accounting for bash, single quotes, or character constraints in git branch names using IFS and base64). In the demo, a comment-triggered workflow (`@hooli-bot analyze`) is exploited to dump memory and harvest a GitHub App private key, which is then used to pivot from public to private repositories. - **LotP and Stealth Techniques**: Franceu details how multiple low-risk primitives (such as config overrides, DNS exfiltration, and XSLT file writes) can chain together to poison shell execution. He also outlines a stealth technique using `git notes` (up to 100MB) and `memfd_create` as fileless staging mechanisms to avoid alerting pipeline telemetry. - **Cache Poisoning to Cloud Takeover**: In a private repository lacking direct secrets, an injection vulnerability in a benchmark workflow is used to poison build cache dependencies (`setup-go`). When a privileged `deploy` workflow runs, it pulls the poisoned cache, triggering an implant that captures GCP OIDC service account tokens to access protected cloud storage buckets. - **Self-Hosted Runner Persistence**: Harvesting an SSH key from a private repository's documentation grants write access to push a branch. By exploiting a self-hosted runner and unsetting the `runner tracking ID`, the implant survives job termination. This persistence allows the attacker to intercept subsequent privileged workflows running on the non-ephemeral VM and access restricted cloud assets.

### Takeaways - **Treat CI/CD as Production**: CI/CD pipelines function essentially as 'RCE as a service' and act as gateways to production environments; they must be defended and threat-modeled as critical infrastructure rather than simple glue code. - **Shifted Threat Models**: Organizations with only private repositories remain vulnerable to enterprise takeover scenarios, phishing, and internal threats, where low-privilege tokens or bug tracker interactions can trigger vulnerable automated workflows. - **Defense in Depth**: Ephemeral tokens (OIDC) reduce exposure but are insufficient on their own if workflows permit dwell time or arbitrary execution. Maintainers must eliminate untrusted input interpolations in workflow YAML, enforce ephemeral runner lifecycles, and carefully configure cache and runner isolation.