BUILD. PUSH. BREACH. – �HOW I COMPROMISED YOUR PROD INFRA

- Nirmal Thapa (@tnirmalz)

$ WHOAMI

• Offensive Security Consultant @ StickmanCyber
• Occasional Bug Bounty Hunter & CTF Player
• Acknowledged by Google, Facebook, Apple, Dell, AT&T, US DoD, Pinterest, Swisscom, Coinbase.

AGENDA

• Modern Attack Surface
• Real World Attack Chains
• Key Takeaways & Prevention
• Q&A

​

​

DISCLAIMER

• All demonstrations in this talk are based on real world engagements, freelance security assessments and bug bounties. Proper permissions were obtained for privilege escalation and post exploitation.
• Always respect scope and rules of engagement.
• Do not perform unauthorized testing.
• Verify whether post-exploitation is allowed before proceeding.

THE MODERN ATTACK SURFACE

• Identity and Access (AWS IAM, Okta, Google Workspace, Azure AD, API Keys, Service accounts)
• Cloud Infrastructure (AWS/GCP/Azure, Compute Instances, Storage Buckets, VPCs, Security groups)
• Containers & Orchestration (Docker, Kubernetes, Secrets inside containers)
• Source Code platforms, CI/CD & Supply Chain (GitHub/Gitlab, public repos/branches/commits, build pipelines - GitHub Actions/Gitlab CI, Artifacts, Dependencies, pipeline secrets and logs)
• Frontend (Javascript - React, Angular, etc., Client-side API keys, Browser trust abuse)
• Backend (Internal/External APIs, Admin panels, Microservices, Debug endpoints)
• Humans & OpSec (The Weakest Link)
• ….phewww… so many things happening under the hood.

SPOT ANY “BUG” HERE?

REAL WORLD ATTACK #1

• Harmless Makefile, Docker Images and Full Org Takeover!
• Fun story - @maskop9 was sharing his screen and I noticed a browser tab with “makefile”, so I also randomly had a look.
• Makefile gave the hint about org’s DockerHub account
• Many internal docker images were published
• Shell on docker images -> docker run -it --rm org/image:latest /bin/sh
• Downloaded some docker images -> Obtain Shell -> Check for hardcoded secrets and env variables
• Gained access to secrets/tokens, third party API keys, S3 buckets (user data, frontend CSS/JS files), logs containing every single requests made by their users and so on.�

REAL WORLD ATTACK #2

• Leaked GitHub Token in older commits leads to full GitHub org takeover
• Exhausted testing in a wild scope bug bounty program
• Checked their GitHub org and found 350+ repos
• Had a crazy thought of downloading every repos and check for ghp_ pattern (GitHub PAT) in all branches/commit
• Found a valid GitHub token which had full admin permissions (pull/push, workflows)
• Pushed a POC text in a repo which got published & deployed immediately in both prod/staging.

REAL WORLD ATTACK #3

• Gaining Access to Internal Gitlab via leaked secret in GitHub
• An org with BBP was breached twice recently so the target looked interesting.
• Obtained an internal domain (abcxyz.com) while reviewing android app
• GitHub recon led to a repo where abcxyz.com was hardcoded with a GitLab token.
• The repo hosted a NPM package, so I was trying to authenticate to the NPM registry of Gitlab and pull private npm packages using the leaked token.
• After many unsuccessful attempts, later found out that the token can be used to access everything of the Internal Gitlab 🤦‍♂️- NPM registry, Docker registry, Internal Source code repos, CI/CD pipelines, secrets and variables.
• Impact? Full access to the Internal Gitlab! Pulled some repos and docker images along with hardcoded secrets to demonstrate the impact.

REAL WORLD ATTACK #4

• Harbor + CVE-2022-46463, a match made in heaven.
• Harbor = Open-Source container registry used to host docker images
• CVE-2022-46463 = Access control issue which allows attackers to pull private docker images
• docker run -u 0 -it --rm --entrypoint /bin/sh harbor.example.com/prod/internal-image:latest
• Got access to AWS keys, S3 buckets hosting static files, users KYC data and other API keys.

​

REAL WORLD ATTACK #5

• Exposed Springboot Actuator Heapdump leads to full AWS access
• Target tech stack = Java Spring Boot
• /actuator/heapdump = 403 error
• /%61%63%74%75%61%74%6f%72/heapdump = BYPASSED! (URL encoding for “actuator”)
• Heapdump = Full memory snapshot of the java app (often contains data like secrets, env variables, internal URLs, auth tokens/cookies)
• Download heapdump file and check strings for known secret patterns (strings heapdump|grep –E ‘password|secret|AWS|username……’)
• Obtained live bearer tokens, database credentials and AWS keys with full access (Production EC2, S3 buckets, RDS, ECS) to the org!

Tip: If you have valid AWS keys, you can use aws_consoler tool to convert AWS CLI access to AWS Console access!

​

(https://github.com/NetSPI/aws_consoler)

REAL WORLD ATTACK #6 - REACT2SHELL (CVE-2025-55182)

• RCE 0day in React/NextJS based web applications
• The day it came out, everything on the internet were vulnerable.
• You could literally RCE anything because most of the modern apps use React/NextJS for frontend.
• Reported more than a dozen of BBP targets vulnerable to react2shell on the first week (almost all were dupes or N/A)
• Took a break, sprayed the targets after 1 month and still vulnerable??!

Similar pattern again – React2Shell -> Reverse shell -> Exposed git repos with github PAT,

Hardcoded secrets, AWS credentials, API keys, etc.

​

​

OTHER FINDINGS

• .git/config with internal source codes and github PATs exposed in public
• Data leaks in GitHub – Username/Password, API keys, SSH private keys, internal URLs
• Data leaks in Docker Hub, remember - any exposed docker image is a walking root shell by default!
• Nginx Off-by-slash misconfig (/static../.git/config, /js../admin)
• Countless Subdomain Takeovers – Github pages, AWS S3 and some uncommon ones

​

KEY TAKEAWAYS

• “Low Impact” Is a Myth
• Identity Is the New Perimeter (Tokens > passwords, one key can unlock everything)
• Your Stack Is Deeply Interconnected (Frontend, Backend, CI/CD); a break in one = risk to all
• Defense Must Be Layered - Least privilege everywhere, Secrets management (not hardcoding), Continuous monitoring & auditing

Thank You ☺