Skip to content

Latest commit

 

History

History
89 lines (54 loc) · 5.39 KB

gcp-compute-privesc.md

File metadata and controls

89 lines (54 loc) · 5.39 KB
Raw

GCP - Compute Privesc

Support HackTricks and get benefits!

compute

compute.projects.setCommonInstanceMetadata

With that permission you can modify the metadata information of an instance and change the authorized keys of a user, or create a new user with sudo permissions. Therefore, you will be able to exec via SSH into any VM instance and steal the GCP Service Account the Instance is running with.
Limitations:

  • Note that GCP Service Accounts running in VM instances by default have a very limited scope
  • You will need to be able to contact the SSH server to login

For more information about how to exploit this permission check:

{% content-ref url="gcp-local-privilege-escalation-ssh-pivoting.md" %} gcp-local-privilege-escalation-ssh-pivoting.md {% endcontent-ref %}

compute.instances.setMetadata

This permission gives the same privileges as the previous permission but over a specific instances instead to a whole project. The same exploits and limitations as for the previous section applies.

compute.instances.setIamPolicy

This kind of permission will allow you to grant yourself a role with the previous permissions and escalate privileges abusing them.

compute.instances.osLogin

If OSLogin is enabled in the instance, with this permission you can just run gcloud compute ssh [INSTANCE] and connect to the instance. You won't have root privs inside the instance.

compute.instances.osAdminLogin

If OSLogin is enabled in the instance, with this permission you can just run gcloud compute ssh [INSTANCE] and connect to the instance. You will have root privs inside the instance.

compute.instances.create,iam.serviceAccounts.actAs

This method creates a new Compute Engine instance with a specified Service Account, then sends the token belonging to that Service Account to an external server.

The following additional permissions are required for this method:

  • compute.disks.create
  • compute.instances.create
  • compute.instances.setMetadata
  • compute.instances.setServiceAccount
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp
  • iam.serviceAccounts.actAs

The exploit script for this method can be found here.

osconfig.patchDeployments.create | osconfig.patchJobs.exec

If you have the osconfig.patchDeployments.create or **osconfig.patchJobs.exec ** permissions you can create a patch job or deployment. This will enable you to move laterally in the environment and gain code execution on all the compute instances within a project.

If you want to manually exploit this you will need to create either a patch job or deployment for a patch job run:

gcloud compute os-config patch-jobs execute --file=patch.json

To deploy a patch deployment:

gcloud compute os-config patch-deployments create my-update --file=patch.json

Automated tooling such as patchy exists to detect lax permissions and automatically move laterally.

Support HackTricks and get benefits!