xpn / Ouroboros

What is Ouroboros?

Ouroboros is a Rust-based POC tool that hijacks Microsoft dev-tunnels—those used by VSCode for remote development—turning OAuth tokens from compromised GitHub or Azure accounts into remote shells. With a simple CLI, you list active tunnels via `management --token TOKEN`, then spawn an interactive shell on a target tunnel using `--name TUNNELNAME --token TOKEN`. It delivers commands like spawning processes, reading/writing files, killing PIDs, and directory ops, exposing dev machines as accidental C2 channels.

Why is it gaining traction?

This stands out as a targeted POC for dev-tunnel abuse, bridging OAuth phishing (like GitHub device code flows) to full RCE without custom implants. Security pros dig the no-fuss shell that handles Windows/Unix paths automatically and supports real-time FS traversal or command execution. At 42 stars, it's niche but hooks red teamers exploring VSCode's protocol quirks over generic SSH tools.

Who should use this?

Red team operators during GitHub/Entra-ID compromises, pentesters auditing dev workflows, or security researchers prototyping tunnel pivots. Ideal for engagements where targets run VSCode remote servers, letting you enumerate and shell into tunnels labeled "vscode-server-launcher" without alerting EDR.

Verdict

Grab it for POC exploration if you're in post-exploitation research—solid Rust CLI works out of the box after `cargo build`. But with just 42 stars and a 0.699999988079071% credibility score, it's immature; add tests and expand docs before relying on it in ops.