GCP - Composer Enum

Support HackTricks

Basic Information

Google Cloud Composer is a fully managed workflow orchestration service built on Apache Airflow. It enables you to author, schedule, and monitor pipelines that span across clouds and on-premises data centers. With GCP Composer, you can easily integrate your workflows with other Google Cloud services, facilitating efficient data integration and analysis tasks. This service is designed to simplify the complexity of managing cloud-based data workflows, making it a valuable tool for data engineers and developers handling large-scale data processing tasks.

Enumeration

# Get envs info
gcloud composer environments list --locations <loc>
gcloud composer environments describe --location <loc> <environment>

# Get list of dags
gcloud composer environments storage dags list --environment <environment> --location <loc>
# Download dags code
mkdir /tmp/dags
gcloud composer environments storage dags export --environment <environment> --location <loc> --destination /tmp/dags

# List Data from composer
gcloud composer environments storage data list --environment <environment> --location <loc>
# Download data
mkdir /tmp/data
gcloud composer environments storage data export --environment <environment> --location <loc> --destination /tmp/data

# List Plugins from composer
gcloud composer environments storage plugins list --environment <environment> --location <loc>
# Download plugins
mkdir /tmp/plugins
gcloud composer environments storage data export --environment <environment> --location <loc> --destination /tmp/plugins

Privesc

In the following page you can check how to abuse composer permissions to escalate privileges:

GCP - Composer Privesc
Support HackTricks

Last updated