Misc

KONTINUERLIG: From Heredoc Injection to Secret Extraction via GitHub Actions - Hack.lu 2025

Root-cause analysis and exploitation of a GitHub Actions CI/CD pipeline (Hack.lu CTF 2025). A pull_request_target misconfiguration is leveraged through heredoc injection into GITHUB_ENV, LD_PRELOAD hijacking, and Python module shadowing to cross a privilege boundary. From there, symlink-based Docker build-context manipulation and Problem Matcher abuse chain together to bypass secret redaction and exfiltrate a repository secret.