GCP - Cloudbuild Privesc
cloudbuild
For more information about Cloud Build check:
GCP - Cloud Build Enumcloudbuild.builds.create
cloudbuild.builds.create
With this permission you can submit a cloud build. The cloudbuild machine will have in it’s filesystem by default a token of the cloudbuild Service Account: <PROJECT_NUMBER>@cloudbuild.gserviceaccount.com
. However, you can indicate any service account inside the project in the cloudbuild configuration.
Therefore, you can just make the machine exfiltrate to your server the token or get a reverse shell inside of it and get yourself the token (the file containing the token might change).
You can find the original exploit script here on GitHub (but the location it's taking the token from didn't work for me). Therefore, check a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to get a reverse shell inside the cloudbuild machine and steal it here (in the code you can find how to specify other service accounts).
For a more in-depth explanation, visit https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/
cloudbuild.builds.update
cloudbuild.builds.update
Potentially with this permission you will be able to update a cloud build and just steal the service account token like it was performed with the previous permission (but unfortunately at the time of this writing I couldn't find any way to call that API).
TODO
cloudbuild.repositories.accessReadToken
cloudbuild.repositories.accessReadToken
With this permission the user can get the read access token used to access the repository:
cloudbuild.repositories.accessReadWriteToken
cloudbuild.repositories.accessReadWriteToken
With this permission the user can get the read and write access token used to access the repository:
cloudbuild.connections.fetchLinkableRepositories
cloudbuild.connections.fetchLinkableRepositories
With this permission you can get the repos the connection has access to:
Last updated