smokedmeat is a CI/CD red team framework that chains workflow injection findings from poutine into authorized post-exploitation, secret extraction, and cloud pivoting exercises against pipelines you own.
| Tool | boostsecurityio/smokedmeat — a Go-based CI/CD red team framework combining SAST analysis, implant delivery, and cloud pivoting |
| Category | CI/CD post-exploitation and red team tooling |
| Primary Use | Demonstrating supply chain attack paths in authorized engagements: scanning GitHub Actions workflows for injection flaws, deploying an implant on a runner, and mapping blast radius into cloud providers |
| Safe Use | Explicitly restricted by the README to authorized security testing on systems you own or have written permission to test; the recommended target is the deliberately vulnerable whooli playground |
| Telemetry Note | Deliberately loud by design: PRs, issues, comments, and workflow dispatches used for delivery leave visible audit trails in GitHub, and the implant beacons over HTTP to the Kitchen teamserver |
smokedmeat, published by boostsecurityio and written in Go, self-describes as "like Metasploit, but for CI/CD pipelines," and the description is more accurate than most marketing lines. It is a complete post-exploitation framework aimed at build infrastructure: point it at a GitHub organization, let it identify vulnerable Actions workflows, deliver an implant to a compromised runner, and then pivot through cloud providers and extract secrets. The README is refreshingly explicit about intent — the project exists because CI/CD threats are underestimated and traditional training rarely covers supply chain techniques — and it carries an unmissable warning that the tool is for authorized testing only, against systems you own or have explicit written permission to test. From the makers of the poutine build pipeline SAST scanner at BoostSecurity Labs, it has accumulated 381 stars and is licensed under AGPL-3.0.
The workflow follows four phases. First, Analyze: an embedded copy of poutine scans an organization's GitHub Actions workflows for injection vulnerabilities, dangerous triggers, and unsafe checkout patterns. Second, Exploit: a stager is deployed via pull request, issue, comment, or workflow dispatch, so that when the vulnerable workflow executes, the runner downloads and executes the implant. Third, Post-exploit: secrets are extracted from runner memory, GitHub token permissions enumerated, private keys located, and loot collected. Fourth, Pivot: captured credentials fund lateral movement into private repositories, GitHub App tokens, OIDC-exchanged cloud access, and SSH deploy keys. What distinguishes the design philosophy is its stated stance of "bold and noisy" — this is not an EDR evasion tool but a demonstration of how deep a CI/CD compromise reaches before anything triggers an alert.
Internally, the architecture reads like a compact C2 stack with food-themed codenames. The operator TUI, called Counter, is built on Bubbletea v2 and Lipgloss v2 with Ultraviolet layout, and it drives the full analysis-delivery-post-exploitation workflow through a seven-step setup wizard, attack tree navigation, an exploit wizard, a loot stash, omnibox search, tab completion, and OSC 8 hyperlinks. It talks over WebSocket to Kitchen, the C2 teamserver, which is an API and WebSocket server managing operator sessions, stagers, callbacks, and persistent graph state. Kitchen also serves a browser-based attack graph at /graph, rendered live with Cytoscape.js, so a second operator or a stakeholder watching a demo can follow the exercise as it unfolds.
The implant itself is named Brisket. Once a stager lands on a GitHub Actions runner via a malicious pull request triggering a vulnerable workflow, Brisket handles beaconing, command execution, and pivoting back to the teamserver. The message fabric underneath is NATS JetStream, with state persisted in a BBolt database, and the attack graph — modeled with hmdsefi/gograph — tracks org, repo, workflow, job, vulnerability, token, and cloud nodes as a directed graph. The teamserver supports SSH or token authentication, proxies GitHub API calls so tokens stay server-side, and uses Caddy for auto-TLS when deployed in hosted mode.
The reconnaissance layer is broader than GitHub alone. SmokedMeat auto-detects six CI platforms — GitHub Actions, GitLab CI, Azure DevOps, CircleCI, Jenkins, and Bitbucket — classifies secrets it encounters, probes OIDC availability, and gathers runner metadata. On the analysis side, beyond the embedded poutine SAST for injection flaws and workflow if: gate classification, it embeds gitleaks with custom rules to deep-scan git history for private keys and PATs. This combination means the tool front-loads a defensible, evidence-based finding inventory before any exploitation happens, which is exactly the shape a professional engagement report wants.
The post-exploitation capabilities are where the tool earns its red team label. It scans the Runner.Worker process memory via /proc (using an embedded component called gump) to recover unmasked secrets.*, vars.*, and GITHUB_TOKEN permission maps that GitHub deliberately hides from logs — a genuinely instructive demonstration of why masked secrets in CI logs are a presentation control, not a protection boundary. Token enumeration probes GitHub tokens against API endpoints to enumerate ten permission scopes, identify token type, and list accessible repositories and organizations, turning a single leaked PAT into a mapped attack surface.
Pivoting extends into cloud territory with unusual depth. SmokedMeat supports OIDC token exchange for AWS via sts:AssumeRoleWithWebIdentity, GCP through Workload Identity Federation, Azure via AAD, and Kubernetes, with post-pivot resource enumeration. A cloud shell command provides durable local sessions with pre-configured gcloud, aws, and az CLIs, plus cloud export and provider quick checks. SSH pivoting probes repositories for deploy key read/write access and offers an ssh shell with a temporary agent, with confirmed access persisted into the graph. GitHub-native pivots include pivot github for repo discovery and pivot app for exchanging a GitHub App PEM for an installation token, auto-queueing discovered repos for further analysis.
Two feature areas deserve particular attention from defenders. The first is LOTP — Living Off The Pipeline — a catalog of fifteen build tools (npm, pip, cargo, make, docker, gradle, maven, and more) with config-file payloads that achieve code execution during install or build steps, directly analogous to living-off-the-land binaries but for build tooling. The second is Actions cache poisoning: the tool performs writer/victim classification, predicts exact cache keys, stages archives via the Actions Cache API, and arms them with the implant, all through a wizard-driven flow. Injection payload generation is context-aware across eight vectors — branch name, PR title and body, commit message, issue title and body, github-script, and bash run — with constraint-aware techniques.
Getting started is deliberately low-friction, and the onboarding path itself encodes the authorized-use posture. With Docker and make installed — Go is not required for the pinned release — a git clone https://github.com/boostsecurityio/smokedmeat.git followed by make quickstart starts the stable release stack locally and launches Counter against the local Kitchen. The recommended first target is whooli, SmokedMeat's own deliberately vulnerable CI/CD playground organization, with a classic PAT scoped to public_repo. The setup wizard then walks through token entry, target selection, and workflow analysis. make quickstart-down and make quickstart-purge clean up afterwards; make dev-quickstart serves contributors working from the Go 1.26+ source tree, spinning up cloudflared, nats, and the teamserver.
For detection engineers, the tool is almost a curriculum. Every delivery method — PRs, issues, comments, workflow dispatches — leaves a visible, attributable audit trail in GitHub's interface and API logs, and the implant's HTTP beaconing to Kitchen is network-observable by design. The memory-scanning technique against Runner.Worker and the cache poisoning flow both map to concrete defensive questions: are runners ephemeral and isolated, is OIDC trust scoped tightly, are cache writers restricted, and would your monitoring catch a stager fetching a binary mid-build? The README's target audience list — red teams, pentesters, detection engineers, researchers, and bug bounty hunters — reflects that dual value: the same artifact set that demonstrates compromise to a stakeholder also tells a blue team precisely which telemetry they were missing.
One operational hygiene note: Counter phones home at startup to check for newer releases, and this can be disabled by setting the SMOKEDMEAT_DISABLE_VERSION_CHECK environment variable — worth knowing both for operators who care about egress minimization and for defenders characterizing the tool in a lab. The repo also ships a real test culture for a framework of this type: make test, make lint, make e2e-smoke for a fast public exploit smoke path, and make e2e-goat for a full challenge run, which signals the maintainers treat regression behavior in exploitation logic as first-class engineering. Between the embedded poutine analysis, the whooli playground, and the deliberately noisy posture, SmokedMeat positions itself less as a stealth weapon and more as a training and validation instrument for the pipeline attack surface most enterprises still haven't rehearsed defending.
boostsecurityio/smokedmeat.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.