Post · bonfire.cafe

jonny (nonvenomous)

@jonny@neuromatch.social · 9 months ago

@tuban_muzuru@ohai.social there's just a full on private key with the ssh-keygen command used to make it as the filename in one of your repos
https://github.com/dweese/RustRabbitMQ/blob/bae9701fe5e6b285188c6482f4c77294ed5c2953/ssh-keygen%20-t%20ed25519%20-C%20%22danweese%40gmail.com%22

A file within "RustRabbitMQ", a repo by @dweese on github. the file is named "ssh-keygen -t ed25519 -C "danweese@gmail.com"" - as in that is not the contents of the file, the filename is a shell command.

the contents of the file are a private key. reproduced here because it's already in a freaking git repo and fully compromised

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACAhv8EAWH//Hfea2DfiKbikpGbGQuw2JIvmaUy6DAa+4QAAAKBOYOh+TmDo
fgAAAAtzc2gtZWQyNTUxOQAAACAhv8EAWH//Hfea2DfiKbikpGbGQuw2JIvmaUy6DAa+4Q
AAAEDc30DsYm75sdj/6cTZ4gA/i81AlYeJhyYc7Db6zWA4HyG/wQBYf/8d95rYN+IpuKSk
ZsZC7DYki+ZpTLoMBr7hAAAAFnlvdXJfZW1haWxAZXhhbXBsZS5jb20BAgMEBQYH
-----END OPENSSH PRIVATE KEY----- — A file within "RustRabbitMQ", a repo by @dweese on github. the file is named "ssh-keygen -t ed25519 -C "danweese@gmail.com"" - as in that is not the contents of the file, the filename is a shell command. the contents of the file are a private key. reproduced here because it's already in a freaking git repo and fully compromised -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACAhv8EAWH//Hfea2DfiKbikpGbGQuw2JIvmaUy6DAa+4QAAAKBOYOh+TmDo fgAAAAtzc2gtZWQyNTUxOQAAACAhv8EAWH//Hfea2DfiKbikpGbGQuw2JIvmaUy6DAa+4Q AAAEDc30DsYm75sdj/6cTZ4gA/i81AlYeJhyYc7Db6zWA4HyG/wQBYf/8d95rYN+IpuKSk ZsZC7DYki+ZpTLoMBr7hAAAAFnlvdXJfZW1haWxAZXhhbXBsZS5jb20BAgMEBQYH -----END OPENSSH PRIVATE KEY-----

0

No replies yet

Be the first to share your thoughts.