joernchen

GitHub RCE by Environment variable injection Bug Bounty writeup

Disclaimer: I'll keep this really short but  I hope you'll get the key points.

GitHub blogged a while ago about some internal tool called gerve:
https://github.com/blog/530-how-we-made-github-fast

Upon git+sshing to github.com gerve basically looks up your permission
on the repo you want to interact with. Then it bounces you further in
another forced SSH session to the back end where the repo actually is.

icholy

# Demo http://ascii.io/a/3019

# build
gdbb () {

  # build with debug flags
  go build -gcflags "-N -l" -o out

  # make sure the build didn't fail
  if [ $? != 0 ]; then return; fi

travisperson

#include <iostream>

class Test { 
	public:
		int a,b,c; 
		Test() { a=b=c=10; } 
};
       
int main() { 
	Test *t;