smokedmeat

SmokedMeat

CI/CD Red Team Framework

Like Metasploit, but for CI/CD pipelines.

From the makers of the poutine Build Pipeline SAST scanner at BoostSecurity Labs.

Warning: This tool is for authorized security testing only.

SmokedMeat exists because CI/CD pipeline threats are deeply underestimated. Traditional security training rarely covers supply chain attacks, leaving defenders unprepared for techniques that adversaries actively exploit in the wild.

We built this to give security teams the ability to learn, practice, and validate defenses against advanced CI/CD attack techniques through realistic red team exercises.

Only use against systems you own or have explicit written permission to test.

What is SmokedMeat?

SmokedMeat is a post-exploitation framework for CI/CD pipelines. Point it at a GitHub organization, let it find vulnerable workflows, deploy an implant to a compromised runner, then pivot through cloud providers, extract secrets, and map the blast radius - all from a terminal UI.

What it does:

1. Analyze - Scan an org's GitHub Actions workflows for injection vulnerabilities, dangerous triggers, and unsafe checkout patterns (powered by poutine)
2. Exploit - Deploy a stager via PR, issue, comment, or workflow dispatch. When the vulnerable workflow runs, it downloads and executes the implant on the CI runner.
3. Post-exploit - Extract secrets from runner memory, enumerate GitHub token permissions, scan for private keys, and collect loot
4. Pivot - Use captured credentials to move laterally: discover private repos, mint GitHub App tokens, exchange OIDC tokens for AWS/GCP/Azure access, probe SSH deploy keys

Philosophy: Bold and noisy. This isn't an EDR evasion tool. It's a demonstration framework that shows how deep a CI/CD compromise goes before anything triggers an alert.

Who is it for:

• Red teams validating CI/CD security posture in enterprise environments
• Pentesters demonstrating supply chain attack paths to stakeholders
• Security engineers testing detection and response for pipeline attacks
• Researchers developing new CI/CD exploitation techniques
• Bug bounty hunters exploring supply chain attack surface

Quick Start

To try SmokedMeat for the first time, install Docker and make. Go is not required.

git clone https://github.com/boostsecurityio/smokedmeat.git
cd smokedmeat
make quickstart

make quickstart is the recommended first run. It starts the stable release quickstart stack locally and launches the operator TUI (Counter) against the local C2 teamserver (Kitchen).

Recommended first run:

• Target: whooli
• Token: classic PAT with public_repo

⚠ Prefer a classic PAT. Fine-grained PATs can be too restrictive and may block testing public targets in other orgs, including whooli.

whooli is SmokedMeat's deliberately vulnerable CI/CD attack playground. It is the recommended first target for the public path.

The setup wizard walks you through:

1. GitHub PAT - Enter your token. For private repos, a classic PAT will usually need repo.
2. Target - Enter whooli or your own org/repo
3. Analysis - Scans workflows for vulnerabilities and presents exploitable findings

For the full challenge flow, see the whooli guide or go straight to the whooli GitHub org.

When you are done:

make quickstart-down       # Stop containers
make quickstart-purge      # Stop and delete all data

If you want to work from source instead, see Development.

Development

If you are contributing or iterating on the source tree locally, install Go 1.26+ and use the dev quickstart:

make dev-quickstart

make dev-quickstart builds the local smokedmeat-cloud-shell image, starts cloudflared, nats, and the C2 teamserver (Kitchen), then launches the operator TUI from source.

If you want the infrastructure first and the operator TUI later:

make dev-quickstart-up
make dev-quickstart-counter

When you are done:

make dev-quickstart-down   # Stop containers
make dev-quickstart-purge  # Stop and delete all data

More deployment modes and local development details are in docs/deployment.md.

Core Components

Deployment Modes

Hosted Teamserver runs the C2 teamserver on a dedicated host and the operator TUI natively on each operator workstation.

Architecture

At a high level, the operator TUI (Counter) talks to the C2 teamserver (Kitchen), which manages implants (Brisket) running on compromised CI runners and serves the live attack graph.

┌──────────────┐
│  SSH AGENT   │
│   (Auth)     │
└──────┬───────┘
       │
       ▼
┌──────────────┐                 ┌──────────────┐
│  THE COUNTER │ ───────────────▶│  THE KITCHEN │
│  (Operator)  │    WebSocket    │ (Teamserver) │
│  Bubbletea   │◀─────────────── │              │
│     TUI      │   Events/Graph  │ ┌──────────┐ │
└──────────────┘                 │ │ Database │ │
                                 │ └──────────┘ │
┌──────────────┐                 │              │
│   BROWSER    │ ───────────────▶│              │
│  Graph View  │    WebSocket    │              │
│  Visualizer  │◀─────────────── │              │
└──────────────┘   Live Updates  └──────────────┘
                                   │         ▲
                                   │         │
                        Creates PR │         │ Stager fetches implant binary
                                   │         │ Implant HTTP Beacon/Commands
                                   ▼         │
┌────────────────────────────────────────────┴──────────────────────────────────┐
│  GITHUB.COM                                                                   │
│                                                                               │
│  ┌─────────────────────┐          ┌─────────────────────────────────────────┐ │
│  │  Malicious PR       │ triggers │  GitHub Actions Runner                  │ │
│  │  (Vulnerable        │─────────▶│                                         │ │
│  │   Workflow)         │          │  ┌────────────┐      ┌────────────────┐ │ │
│  └─────────────────────┘          │  │  Stager    │─────▶│  THE BRISKET   │ │ │
│                                   │  │            │      │  (Implant)     │ │ │
│                                   │  └────────────┘      └────────────────┘ │ │
│                                   └─────────────────────────────────────────┘ │
└───────────────────────────────────────────────────────────────────────────────┘

Features

Full details in docs/FEATURES.md.

Technology Stack

Testing

make test          # Unit tests
make lint          # Linter
make e2e-smoke     # Fast public exploit smoke path
make e2e-goat      # Full goat chain to the cloud flag

Prior Art

SmokedMeat builds on research from:

• poutine - Build Pipeline SAST scanner
• LOTP - Living Off The Pipeline techniques
• Gato-X - GitHub Actions enumeration
• Nord-Stream - CI/CD secret extraction
• Sliver - Go C2 architecture patterns
• Mythic - Collaborative workflow design

License

GNU Affero General Public License v3.0 - see LICENSE for details.

Built for defenders who want to understand attacker techniques.