mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-09 03:40:59 -08:00
Translated ['.github/pull_request_template.md', 'src/pentesting-cloud/az
This commit is contained in:
Translator
@@ -2,21 +2,17 @@
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Public Assets Discovery
|
||||
## Öffentliche Ressourcenentdeckung
|
||||
|
||||
One way to discover public cloud resources that belongs to a company is to scrape their webs looking for them. Tools like [**CloudScraper**](https://github.com/jordanpotti/CloudScraper) will scrape the web an search for **links to public cloud resources** (in this case this tools searches `['amazonaws.com', 'digitaloceanspaces.com', 'windows.net', 'storage.googleapis.com', 'aliyuncs.com']`)
|
||||
Eine Möglichkeit, öffentliche Cloud-Ressourcen zu entdecken, die zu einem Unternehmen gehören, besteht darin, deren Webseiten nach ihnen zu durchsuchen. Tools wie [**CloudScraper**](https://github.com/jordanpotti/CloudScraper) durchsuchen das Web und suchen nach **Links zu öffentlichen Cloud-Ressourcen** (in diesem Fall sucht dieses Tool `['amazonaws.com', 'digitaloceanspaces.com', 'windows.net', 'storage.googleapis.com', 'aliyuncs.com']`)
|
||||
|
||||
Note that other cloud resources could be searched for and that some times these resources are hidden behind **subdomains that are pointing them via CNAME registry**.
|
||||
Beachten Sie, dass auch andere Cloud-Ressourcen durchsucht werden könnten und dass manchmal diese Ressourcen hinter **Subdomains versteckt sind, die sie über das CNAME-Register angeben**.
|
||||
|
||||
## Public Resources Brute-Force
|
||||
## Brute-Force öffentlicher Ressourcen
|
||||
|
||||
### Buckets, Firebase, Apps & Cloud Functions
|
||||
|
||||
- [https://github.com/initstring/cloud_enum](https://github.com/initstring/cloud_enum): This tool in GCP brute-force Buckets, Firebase Realtime Databases, Google App Engine sites, and Cloud Functions
|
||||
- [https://github.com/0xsha/CloudBrute](https://github.com/0xsha/CloudBrute): This tool in GCP brute-force Buckets and Apps.
|
||||
- [https://github.com/initstring/cloud_enum](https://github.com/initstring/cloud_enum): Dieses Tool in GCP führt Brute-Force-Angriffe auf Buckets, Firebase Realtime-Datenbanken, Google App Engine-Seiten und Cloud Functions durch.
|
||||
- [https://github.com/0xsha/CloudBrute](https://github.com/0xsha/CloudBrute): Dieses Tool in GCP führt Brute-Force-Angriffe auf Buckets und Apps durch.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,26 +2,25 @@
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## API Keys
|
||||
## API-Schlüssel
|
||||
|
||||
For more information about API Keys check:
|
||||
Für weitere Informationen zu API-Schlüsseln siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-api-keys-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### OSINT techniques
|
||||
### OSINT-Techniken
|
||||
|
||||
**Google API Keys are widely used by any kind of applications** that uses from the client side. It's common to find them in for websites source code or network requests, in mobile applications or just searching for regexes in platforms like Github.
|
||||
**Google API-Schlüssel werden von allen Arten von Anwendungen verwendet**, die von der Client-Seite aus arbeiten. Es ist üblich, sie im Quellcode von Websites oder in Netzwerk-Anfragen, in mobilen Anwendungen oder einfach durch das Suchen nach Regex in Plattformen wie Github zu finden.
|
||||
|
||||
The regex is: **`AIza[0-9A-Za-z_-]{35}`**
|
||||
Der Regex ist: **`AIza[0-9A-Za-z_-]{35}`**
|
||||
|
||||
Search it for example in Github following: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
|
||||
Suche ihn zum Beispiel in Github unter: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
|
||||
|
||||
### Check origin GCP project - `apikeys.keys.lookup`
|
||||
|
||||
This is extremely useful to check to **which GCP project an API key that you have found belongs to**:
|
||||
### Überprüfen des Ursprungsprojekts in GCP - `apikeys.keys.lookup`
|
||||
|
||||
Dies ist äußerst nützlich, um zu überprüfen, **zu welchem GCP-Projekt ein gefundener API-Schlüssel gehört**:
|
||||
```bash
|
||||
# If you have permissions
|
||||
gcloud services api-keys lookup AIzaSyD[...]uE8Y
|
||||
@@ -33,24 +32,19 @@ gcloud services api-keys lookup AIzaSy[...]Qbkd_oYE
|
||||
ERROR: (gcloud.services.api-keys.lookup) PERMISSION_DENIED: Permission 'apikeys.keys.lookup' denied on resource project.
|
||||
Help Token: ARD_zUaNgNilGTg9oYUnMhfa3foMvL7qspRpBJ-YZog8RLbTjCTBolt_WjQQ3myTaOqu4VnPc5IbA6JrQN83CkGH6nNLum6wS4j1HF_7HiCUBHVN
|
||||
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
|
||||
violations:
|
||||
- subject: ?error_code=110002&service=cloudresourcemanager.googleapis.com&permission=serviceusage.apiKeys.getProjectForKey&resource=projects/89123452509
|
||||
type: googleapis.com
|
||||
violations:
|
||||
- subject: ?error_code=110002&service=cloudresourcemanager.googleapis.com&permission=serviceusage.apiKeys.getProjectForKey&resource=projects/89123452509
|
||||
type: googleapis.com
|
||||
- '@type': type.googleapis.com/google.rpc.ErrorInfo
|
||||
domain: apikeys.googleapis.com
|
||||
metadata:
|
||||
permission: serviceusage.apiKeys.getProjectForKey
|
||||
resource: projects/89123452509
|
||||
service: cloudresourcemanager.googleapis.com
|
||||
reason: AUTH_PERMISSION_DENIED
|
||||
domain: apikeys.googleapis.com
|
||||
metadata:
|
||||
permission: serviceusage.apiKeys.getProjectForKey
|
||||
resource: projects/89123452509
|
||||
service: cloudresourcemanager.googleapis.com
|
||||
reason: AUTH_PERMISSION_DENIED
|
||||
```
|
||||
### Brute Force API-Endpunkte
|
||||
|
||||
### Brute Force API endspoints
|
||||
|
||||
As you might not know which APIs are enabled in the project, it would be interesting to run the tool [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**
|
||||
Da Sie möglicherweise nicht wissen, welche APIs im Projekt aktiviert sind, wäre es interessant, das Tool [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) auszuführen und zu überprüfen, **auf was Sie mit dem API-Schlüssel zugreifen können.**
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## App Engine
|
||||
|
||||
For more information about App Engine check:
|
||||
Für weitere Informationen über App Engine siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-app-engine-enum.md
|
||||
@@ -12,18 +12,14 @@ For more information about App Engine check:
|
||||
|
||||
### Brute Force Subdomains
|
||||
|
||||
As mentioned the URL assigned to App Engine web pages is **`<project-uniq-name>.appspot.com`** and if a service name is used it'll be: **`<servicename>-dot-<project-uniq-name>.appspot.com`**.
|
||||
Wie erwähnt, ist die URL, die den App Engine-Webseiten zugewiesen ist, **`<project-uniq-name>.appspot.com`** und wenn ein Dienstname verwendet wird, lautet sie: **`<servicename>-dot-<project-uniq-name>.appspot.com`**.
|
||||
|
||||
As the **`project-uniq-name`** can be set by the person creating the project, they might be not that random and **brute-forcing them could find App Engine web apps exposed by companies**.
|
||||
Da der **`project-uniq-name`** von der Person, die das Projekt erstellt, festgelegt werden kann, sind sie möglicherweise nicht so zufällig und **das Brute-Forcen könnte App Engine-Webanwendungen finden, die von Unternehmen exponiert sind**.
|
||||
|
||||
You could use tools like the ones indicated in:
|
||||
Du könntest Tools wie die in:
|
||||
|
||||
{{#ref}}
|
||||
./
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Artifact Registry
|
||||
|
||||
For more information about Artifact Registry check:
|
||||
Für weitere Informationen über das Artifact Registry siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-artifact-registry-enum.md
|
||||
@@ -12,14 +12,10 @@ For more information about Artifact Registry check:
|
||||
|
||||
### Dependency Confusion
|
||||
|
||||
Check the following page:
|
||||
Überprüfen Sie die folgende Seite:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-persistence/gcp-artifact-registry-persistence.md
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Cloud Build
|
||||
|
||||
For more information about Cloud Build check:
|
||||
Für weitere Informationen über Cloud Build siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-cloud-build-enum.md
|
||||
@@ -12,35 +12,31 @@ For more information about Cloud Build check:
|
||||
|
||||
### cloudbuild.yml
|
||||
|
||||
If you compromise write access over a repository containing a file named **`cloudbuild.yml`**, you could **backdoor** this file, which specifies the **commands that are going to be executed** inside a Cloud Build and exfiltrate the secrets, compromise what is done and also compromise the **Cloud Build service account.**
|
||||
Wenn du Schreibzugriff auf ein Repository mit einer Datei namens **`cloudbuild.yml`** erlangst, könntest du diese Datei **hintertüren**, die die **Befehle angibt, die innerhalb eines Cloud Builds ausgeführt werden sollen** und die Geheimnisse exfiltrieren, was durchgeführt wird, kompromittieren und auch das **Cloud Build-Dienstkonto** gefährden.
|
||||
|
||||
> [!NOTE]
|
||||
> Note that GCP has the option to allow administrators to control the execution of build systems from external PRs via "Comment Control". Comment Control is a feature where collaborators/project owners **need to comment “/gcbrun” to trigger the build** against the PR and using this feature inherently prevents anyone on the internet from triggering your build systems.
|
||||
> Beachte, dass GCP die Option hat, Administratoren die Kontrolle über die Ausführung von Build-Systemen aus externen PRs über "Comment Control" zu ermöglichen. Comment Control ist eine Funktion, bei der Mitarbeiter/Projektinhaber **kommentieren müssen “/gcbrun”, um den Build** gegen den PR auszulösen, und die Verwendung dieser Funktion verhindert von Natur aus, dass jemand im Internet deine Build-Systeme auslöst.
|
||||
|
||||
For some related information you could check the page about how to attack Github Actions (similar to this):
|
||||
Für einige verwandte Informationen kannst du die Seite über den Angriff auf Github Actions (ähnlich wie dies) überprüfen:
|
||||
|
||||
{{#ref}}
|
||||
../../../pentesting-ci-cd/github-security/abusing-github-actions/
|
||||
{{#endref}}
|
||||
|
||||
### PR Approvals
|
||||
### PR Genehmigungen
|
||||
|
||||
When the trigger is PR because **anyone can perform PRs to public repositories** it would be very dangerous to just **allow the execution of the trigger with any PR**. Therefore, by default, the execution will only be **automatic for owners and collaborators**, and in order to execute the trigger with other users PRs an owner or collaborator must comment `/gcbrun`.
|
||||
Wenn der Trigger PR ist, weil **jeder PRs zu öffentlichen Repositories durchführen kann**, wäre es sehr gefährlich, einfach **die Ausführung des Triggers mit jedem PR zuzulassen**. Daher wird die Ausführung standardmäßig nur für **Besitzer und Mitarbeiter automatisch** sein, und um den Trigger mit PRs anderer Benutzer auszuführen, muss ein Besitzer oder Mitarbeiter `/gcbrun` kommentieren.
|
||||
|
||||
<figure><img src="../../../images/image (339).png" alt="" width="563"><figcaption></figcaption></figure>
|
||||
|
||||
> [!CAUTION]
|
||||
> Therefore, is this is set to **`Not required`**, an attacker could perform a **PR to the branch** that will trigger the execution adding the malicious code execution to the **`cloudbuild.yml`** file and compromise the cloudbuild execution (note that cloudbuild will download the code FROM the PR, so it will execute the malicious **`cloudbuild.yml`**).
|
||||
> Daher, wenn dies auf **`Nicht erforderlich`** gesetzt ist, könnte ein Angreifer einen **PR zum Branch** durchführen, der die Ausführung auslöst, indem er die bösartige Codeausführung zur **`cloudbuild.yml`**-Datei hinzufügt und die Ausführung von cloudbuild gefährdet (beachte, dass cloudbuild den Code VON dem PR herunterlädt, sodass es die bösartige **`cloudbuild.yml`** ausführt).
|
||||
|
||||
Moreover, it's easy to see if some cloudbuild execution needs to be performed when you send a PR because it appears in Github:
|
||||
Darüber hinaus ist es einfach zu sehen, ob eine cloudbuild-Ausführung durchgeführt werden muss, wenn du einen PR sendest, da sie in Github erscheint:
|
||||
|
||||
<figure><img src="../../../images/image (340).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
> [!WARNING]
|
||||
> Then, even if the cloudbuild is not executed the attacker will be able to see the **project name of a GCP project** that belongs to the company.
|
||||
> Dann, selbst wenn der cloudbuild nicht ausgeführt wird, wird der Angreifer in der Lage sein, den **Projektnamen eines GCP-Projekts** zu sehen, das zur Firma gehört.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Cloud Functions
|
||||
|
||||
More information about Cloud Functions can be found in:
|
||||
Weitere Informationen zu Cloud Functions finden Sie unter:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-cloud-functions-enum.md
|
||||
@@ -12,22 +12,21 @@ More information about Cloud Functions can be found in:
|
||||
|
||||
### Brute Force URls
|
||||
|
||||
**Brute Force the URL format**:
|
||||
**Brute Force das URL-Format**:
|
||||
|
||||
- `https://<region>-<project-gcp-name>.cloudfunctions.net/<func_name>`
|
||||
|
||||
It's easier if you know project names.
|
||||
Es ist einfacher, wenn Sie die Projektnamen kennen.
|
||||
|
||||
Check this page for some tools to perform this brute force:
|
||||
Überprüfen Sie diese Seite für einige Tools, um diesen Brute Force durchzuführen:
|
||||
|
||||
{{#ref}}
|
||||
./
|
||||
{{#endref}}
|
||||
|
||||
### Enumerate Open Cloud Functions
|
||||
|
||||
With the following code [taken from here](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_functions.sh) you can find Cloud Functions that permit unauthenticated invocations.
|
||||
### Offene Cloud Functions auflisten
|
||||
|
||||
Mit dem folgenden Code [hierher entnommen](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_functions.sh) können Sie Cloud Functions finden, die nicht authentifizierte Aufrufe zulassen.
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
@@ -38,44 +37,39 @@ With the following code [taken from here](https://gitlab.com/gitlab-com/gl-secur
|
||||
############################
|
||||
|
||||
for proj in $(gcloud projects list --format="get(projectId)"); do
|
||||
echo "[*] scraping project $proj"
|
||||
echo "[*] scraping project $proj"
|
||||
|
||||
enabled=$(gcloud services list --project "$proj" | grep "Cloud Functions API")
|
||||
enabled=$(gcloud services list --project "$proj" | grep "Cloud Functions API")
|
||||
|
||||
if [ -z "$enabled" ]; then
|
||||
continue
|
||||
fi
|
||||
if [ -z "$enabled" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
for func_region in $(gcloud functions list --quiet --project "$proj" --format="value[separator=','](NAME,REGION)"); do
|
||||
# drop substring from first occurence of "," to end of string.
|
||||
func="${func_region%%,*}"
|
||||
# drop substring from start of string up to last occurence of ","
|
||||
region="${func_region##*,}"
|
||||
ACL="$(gcloud functions get-iam-policy "$func" --project "$proj" --region "$region")"
|
||||
for func_region in $(gcloud functions list --quiet --project "$proj" --format="value[separator=','](NAME,REGION)"); do
|
||||
# drop substring from first occurence of "," to end of string.
|
||||
func="${func_region%%,*}"
|
||||
# drop substring from start of string up to last occurence of ","
|
||||
region="${func_region##*,}"
|
||||
ACL="$(gcloud functions get-iam-policy "$func" --project "$proj" --region "$region")"
|
||||
|
||||
all_users="$(echo "$ACL" | grep allUsers)"
|
||||
all_auth="$(echo "$ACL" | grep allAuthenticatedUsers)"
|
||||
all_users="$(echo "$ACL" | grep allUsers)"
|
||||
all_auth="$(echo "$ACL" | grep allAuthenticatedUsers)"
|
||||
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $proj: $func"
|
||||
fi
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $proj: $func"
|
||||
fi
|
||||
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $proj: $func"
|
||||
fi
|
||||
done
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $proj: $func"
|
||||
fi
|
||||
done
|
||||
done
|
||||
```
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,16 +4,15 @@
|
||||
|
||||
## Cloud Run
|
||||
|
||||
For more information about Cloud Run check:
|
||||
Für weitere Informationen zu Cloud Run siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-cloud-run-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### Enumerate Open Cloud Run
|
||||
|
||||
With the following code [taken from here](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_cloudrun.sh) you can find Cloud Run services that permit unauthenticated invocations.
|
||||
### Offene Cloud Run auflisten
|
||||
|
||||
Mit dem folgenden Code [entnommen von hier](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_cloudrun.sh) können Sie Cloud Run-Dienste finden, die nicht authentifizierte Aufrufe zulassen.
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
@@ -24,40 +23,35 @@ With the following code [taken from here](https://gitlab.com/gitlab-com/gl-secur
|
||||
############################
|
||||
|
||||
for proj in $(gcloud projects list --format="get(projectId)"); do
|
||||
echo "[*] scraping project $proj"
|
||||
echo "[*] scraping project $proj"
|
||||
|
||||
enabled=$(gcloud services list --project "$proj" | grep "Cloud Run API")
|
||||
enabled=$(gcloud services list --project "$proj" | grep "Cloud Run API")
|
||||
|
||||
if [ -z "$enabled" ]; then
|
||||
continue
|
||||
fi
|
||||
if [ -z "$enabled" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
for run in $(gcloud run services list --platform managed --quiet --project $proj --format="get(name)"); do
|
||||
ACL="$(gcloud run services get-iam-policy $run --platform managed --project $proj)"
|
||||
for run in $(gcloud run services list --platform managed --quiet --project $proj --format="get(name)"); do
|
||||
ACL="$(gcloud run services get-iam-policy $run --platform managed --project $proj)"
|
||||
|
||||
all_users="$(echo $ACL | grep allUsers)"
|
||||
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"
|
||||
all_users="$(echo $ACL | grep allUsers)"
|
||||
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"
|
||||
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $proj: $run"
|
||||
fi
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $proj: $run"
|
||||
fi
|
||||
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $proj: $run"
|
||||
fi
|
||||
done
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $proj: $run"
|
||||
fi
|
||||
done
|
||||
done
|
||||
```
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Cloud SQL
|
||||
|
||||
For more infromation about Cloud SQL check:
|
||||
Für weitere Informationen zu Cloud SQL siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-cloud-sql-enum.md
|
||||
@@ -12,18 +12,14 @@ For more infromation about Cloud SQL check:
|
||||
|
||||
### Brute Force
|
||||
|
||||
If you have **access to a Cloud SQL port** because all internet is permitted or for any other reason, you can try to brute force credentials.
|
||||
Wenn Sie **Zugriff auf einen Cloud SQL-Port** haben, weil der gesamte Internetzugang erlaubt ist oder aus einem anderen Grund, können Sie versuchen, die Anmeldeinformationen zu brute-forcen.
|
||||
|
||||
Check this page for **different tools to burte-force** different database technologies:
|
||||
Überprüfen Sie diese Seite für **verschiedene Tools zum Brute-Forcen** verschiedener Datenbanktechnologien:
|
||||
|
||||
{{#ref}}
|
||||
https://book.hacktricks.xyz/generic-methodologies-and-resources/brute-force
|
||||
{{#endref}}
|
||||
|
||||
Remember that with some privileges it's possible to **list all the database users** via GCP API.
|
||||
Denken Sie daran, dass es mit einigen Berechtigungen möglich ist, **alle Datenbankbenutzer** über die GCP-API aufzulisten.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Compute
|
||||
|
||||
For more information about Compute and VPC (Networking) check:
|
||||
Für weitere Informationen zu Compute und VPC (Networking) siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-compute-instances-enum/
|
||||
@@ -12,18 +12,14 @@ For more information about Compute and VPC (Networking) check:
|
||||
|
||||
### SSRF - Server Side Request Forgery
|
||||
|
||||
If a web is **vulnerable to SSRF** and it's possible to **add the metadata header**, an attacker could abuse it to access the SA OAuth token from the metadata endpoint. For more info about SSRF check:
|
||||
Wenn eine Webanwendung **anfällig für SSRF** ist und es möglich ist, **den Metadaten-Header hinzuzufügen**, könnte ein Angreifer dies ausnutzen, um auf das SA OAuth-Token vom Metadaten-Endpunkt zuzugreifen. Für weitere Informationen zu SSRF siehe:
|
||||
|
||||
{{#ref}}
|
||||
https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery
|
||||
{{#endref}}
|
||||
|
||||
### Vulnerable exposed services
|
||||
### Anfällige exponierte Dienste
|
||||
|
||||
If a GCP instance has a vulnerable exposed service an attacker could abuse it to compromise it.
|
||||
Wenn eine GCP-Instanz einen anfälligen exponierten Dienst hat, könnte ein Angreifer dies ausnutzen, um ihn zu kompromittieren.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,18 +4,17 @@
|
||||
|
||||
## Iam & GCP Principals
|
||||
|
||||
For more information check:
|
||||
Für weitere Informationen siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-iam-and-org-policies-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### Is domain used in Workspace?
|
||||
### Wird die Domain in Workspace verwendet?
|
||||
|
||||
1. **Check DNS records**
|
||||
|
||||
If it has a **`google-site-verification`** record it's probable that it's (or it was) using Workspace:
|
||||
1. **Überprüfen Sie die DNS-Einträge**
|
||||
|
||||
Wenn es einen **`google-site-verification`** Eintrag hat, ist es wahrscheinlich, dass es (oder es war) Workspace verwendet:
|
||||
```
|
||||
dig txt hacktricks.xyz
|
||||
|
||||
@@ -24,91 +23,80 @@ hacktricks.xyz. 3600 IN TXT "google-site-verification=2mWyPXMPXEEy6QqWbCfWkxFTc
|
||||
hacktricks.xyz. 3600 IN TXT "google-site-verification=C19PtLcZ1EGyzUYYJTX1Tp6bOGessxzN9gqE-SVKhRA"
|
||||
hacktricks.xyz. 300 IN TXT "v=spf1 include:usb._netblocks.mimecast.com include:_spf.google.com include:_spf.psm.knowbe4.com include:_spf.salesforce.com include:spf.mandrillapp.com ~all"
|
||||
```
|
||||
Wenn etwas wie **`include:_spf.google.com`** erscheint, bestätigt das dies (beachten Sie, dass, wenn es nicht erscheint, es dies nicht ausschließt, da eine Domain in Workspace sein kann, ohne Gmail als E-Mail-Anbieter zu verwenden).
|
||||
|
||||
If something like **`include:_spf.google.com`** also appears it confirms it (note that if it doesn't appear it doesn't denies it as a domain can be in Workspace without using gmail as mail provider).
|
||||
2. **Versuchen Sie, ein Workspace mit dieser Domain einzurichten**
|
||||
|
||||
2. **Try to setup a Workspace with that domain**
|
||||
Eine weitere Möglichkeit besteht darin, zu versuchen, ein Workspace mit der Domain einzurichten. Wenn es **beschwert, dass die Domain bereits verwendet wird** (wie im Bild), wissen Sie, dass sie bereits verwendet wird!
|
||||
|
||||
Another option is to try to setup a Workspace using the domain, if it **complains that the domain is already used** (like in the image), you know it's already used!
|
||||
|
||||
To try to setup a Workspace domain follow: [https://workspace.google.com/business/signup/welcome](https://workspace.google.com/business/signup/welcome)
|
||||
Um eine Workspace-Domain einzurichten, folgen Sie: [https://workspace.google.com/business/signup/welcome](https://workspace.google.com/business/signup/welcome)
|
||||
|
||||
<figure><img src="../../../images/image (330).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
3. **Try to recover the password of an email using that domain**
|
||||
3. **Versuchen Sie, das Passwort einer E-Mail mit dieser Domain wiederherzustellen**
|
||||
|
||||
If you know any valid email address being use din that domain (like: admin@email.com or info@email.com) you can try to **recover the account** in [https://accounts.google.com/signin/v2/recoveryidentifier](https://accounts.google.com/signin/v2/recoveryidentifier), and if try doesn't shows an error indicating that Google has no idea about that account, then it's using Workspace.
|
||||
Wenn Sie eine gültige E-Mail-Adresse kennen, die in dieser Domain verwendet wird (wie: admin@email.com oder info@email.com), können Sie versuchen, **das Konto wiederherzustellen** unter [https://accounts.google.com/signin/v2/recoveryidentifier](https://accounts.google.com/signin/v2/recoveryidentifier). Wenn der Versuch keinen Fehler anzeigt, der darauf hinweist, dass Google keine Ahnung von diesem Konto hat, dann wird Workspace verwendet.
|
||||
|
||||
### Enumerate emails and service accounts
|
||||
### E-Mails und Dienstkonten auflisten
|
||||
|
||||
It's possible to **enumerate valid emails of a Workspace domain and SA emails** by trying to assign them permissions and checking the error messages. For this you just need to have permissions to assign permission to a project (which can be just owned by you).
|
||||
|
||||
Note that to check them but even if they exist not grant them a permission you can use the type **`serviceAccount`** when it's an **`user`** and **`user`** when it's a **`SA`**:
|
||||
Es ist möglich, **gültige E-Mails einer Workspace-Domain und SA-E-Mails aufzulisten**, indem Sie versuchen, ihnen Berechtigungen zuzuweisen und die Fehlermeldungen zu überprüfen. Dafür müssen Sie nur die Berechtigung haben, Berechtigungen für ein Projekt zuzuweisen (das nur Ihnen gehören kann).
|
||||
|
||||
Beachten Sie, dass Sie, um sie zu überprüfen, aber selbst wenn sie existieren, ihnen keine Berechtigung gewähren können, den Typ **`serviceAccount`** verwenden, wenn es sich um einen **`user`** handelt, und **`user`**, wenn es sich um ein **`SA`** handelt:
|
||||
```bash
|
||||
# Try to assign permissions to user 'unvalid-email-34r434f@hacktricks.xyz'
|
||||
# but indicating it's a service account
|
||||
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
|
||||
--member='serviceAccount:unvalid-email-34r434f@hacktricks.xyz' \
|
||||
--role='roles/viewer'
|
||||
--member='serviceAccount:unvalid-email-34r434f@hacktricks.xyz' \
|
||||
--role='roles/viewer'
|
||||
## Response:
|
||||
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User unvalid-email-34r434f@hacktricks.xyz does not exist.
|
||||
|
||||
# Now try with a valid email
|
||||
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
|
||||
--member='serviceAccount:support@hacktricks.xyz' \
|
||||
--role='roles/viewer'
|
||||
--member='serviceAccount:support@hacktricks.xyz' \
|
||||
--role='roles/viewer'
|
||||
# Response:
|
||||
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal support@hacktricks.xyz is of type "user". The principal should appear as "user:support@hacktricks.xyz". See https://cloud.google.com/iam/help/members/types for additional documentation.
|
||||
```
|
||||
Eine schnellere Möglichkeit, Dienstkonten in bekannten Projekten aufzulisten, besteht darin, einfach zu versuchen, auf die URL zuzugreifen: `https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email>`\
|
||||
Zum Beispiel: `https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/appengine-lab-1-tarsget@gcp-labs-3uis1xlx.iam.gserviceaccount.com`
|
||||
|
||||
A faster way to enumerate Service Accounts in know projects is just to try to access to the URL: `https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email>`\
|
||||
For examlpe: `https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/appengine-lab-1-tarsget@gcp-labs-3uis1xlx.iam.gserviceaccount.com`
|
||||
|
||||
If the response is a 403, it means that the SA exists. But if the answer is a 404 it means that it doesn't exist:
|
||||
|
||||
Wenn die Antwort 403 ist, bedeutet das, dass das Dienstkonto existiert. Wenn die Antwort 404 ist, bedeutet das, dass es nicht existiert:
|
||||
```json
|
||||
// Exists
|
||||
{
|
||||
"error": {
|
||||
"code": 403,
|
||||
"message": "Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.",
|
||||
"status": "PERMISSION_DENIED"
|
||||
}
|
||||
"error": {
|
||||
"code": 403,
|
||||
"message": "Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.",
|
||||
"status": "PERMISSION_DENIED"
|
||||
}
|
||||
}
|
||||
|
||||
// Doesn't exist
|
||||
{
|
||||
"error": {
|
||||
"code": 404,
|
||||
"message": "Unknown service account",
|
||||
"status": "NOT_FOUND"
|
||||
}
|
||||
"error": {
|
||||
"code": 404,
|
||||
"message": "Unknown service account",
|
||||
"status": "NOT_FOUND"
|
||||
}
|
||||
}
|
||||
```
|
||||
Beachten Sie, dass die Fehlermeldung anzeigt, dass der Typ nicht gültig ist, wenn die Benutzer-E-Mail gültig war. So konnten wir herausfinden, dass die E-Mail support@hacktricks.xyz existiert, ohne ihr irgendwelche Berechtigungen zu gewähren.
|
||||
|
||||
Note how when the user email was valid the error message indicated that they type isn't, so we managed to discover that the email support@hacktricks.xyz exists without granting it any privileges.
|
||||
|
||||
You can so the **same with Service Accounts** using the type **`user:`** instead of **`serviceAccount:`**:
|
||||
|
||||
Sie können das **gleiche mit Dienstkonten** tun, indem Sie den Typ **`user:`** anstelle von **`serviceAccount:`** verwenden:
|
||||
```bash
|
||||
# Non existent
|
||||
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
|
||||
--member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
|
||||
--role='roles/viewer'
|
||||
--member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
|
||||
--role='roles/viewer'
|
||||
# Response
|
||||
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User <invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com does not exist.
|
||||
|
||||
# Existent
|
||||
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
|
||||
--member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
|
||||
--role='roles/viewer'
|
||||
--member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
|
||||
--role='roles/viewer'
|
||||
# Response
|
||||
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal testing@digital-bonfire-410512.iam.gserviceaccount.com is of type "serviceAccount". The principal should appear as "serviceAccount:testing@digital-bonfire-410512.iam.gserviceaccount.com". See https://cloud.google.com/iam/help/members/types for additional documentation.
|
||||
```
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,21 +4,17 @@
|
||||
|
||||
## Source Repositories
|
||||
|
||||
For more information about Source Repositories check:
|
||||
Für weitere Informationen zu Source Repositories siehe:
|
||||
|
||||
{{#ref}}
|
||||
../gcp-services/gcp-source-repositories-enum.md
|
||||
{{#endref}}
|
||||
|
||||
### Compromise External Repository
|
||||
### Kompromittierung des externen Repositories
|
||||
|
||||
If an external repository is being used via Source Repositories an attacker could add his malicious code to the repository and:
|
||||
Wenn ein externes Repository über Source Repositories verwendet wird, könnte ein Angreifer seinen schädlichen Code in das Repository einfügen und:
|
||||
|
||||
- If someone uses Cloud Shell to develop the repository it could be compromised
|
||||
- if this source repository is used by other GCP services, they could get compromised
|
||||
- Wenn jemand Cloud Shell verwendet, um das Repository zu entwickeln, könnte es kompromittiert werden
|
||||
- Wenn dieses Source Repository von anderen GCP-Diensten verwendet wird, könnten sie kompromittiert werden
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Storage
|
||||
|
||||
For more information about Storage check:
|
||||
Für weitere Informationen über Storage siehe:
|
||||
|
||||
{{#ref}}
|
||||
../../gcp-services/gcp-storage-enum.md
|
||||
@@ -12,28 +12,27 @@ For more information about Storage check:
|
||||
|
||||
### Public Bucket Brute Force
|
||||
|
||||
The **format of an URL** to access a bucket is **`https://storage.googleapis.com/<bucket-name>`.**
|
||||
Das **Format einer URL** zum Zugriff auf einen Bucket ist **`https://storage.googleapis.com/<bucket-name>`.**
|
||||
|
||||
The following tools can be used to generate variations of the name given and search for miss-configured buckets with that names:
|
||||
Die folgenden Tools können verwendet werden, um Variationen des angegebenen Namens zu generieren und nach falsch konfigurierten Buckets mit diesen Namen zu suchen:
|
||||
|
||||
- [https://github.com/RhinoSecurityLabs/GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute)
|
||||
|
||||
**Also the tools** mentioned in:
|
||||
**Auch die Tools** erwähnt in:
|
||||
|
||||
{{#ref}}
|
||||
../
|
||||
{{#endref}}
|
||||
|
||||
If you find that you can **access a bucket** you might be able to **escalate even further**, check:
|
||||
Wenn du feststellst, dass du **auf einen Bucket zugreifen** kannst, könntest du in der Lage sein, **noch weiter zu eskalieren**, siehe:
|
||||
|
||||
{{#ref}}
|
||||
gcp-public-buckets-privilege-escalation.md
|
||||
{{#endref}}
|
||||
|
||||
### Search Open Buckets in Current Account
|
||||
|
||||
With the following script [gathered from here](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_buckets.sh) you can find all the open buckets:
|
||||
### Suche nach offenen Buckets im aktuellen Konto
|
||||
|
||||
Mit dem folgenden Skript [hier gesammelt](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_buckets.sh) kannst du alle offenen Buckets finden:
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
@@ -45,33 +44,28 @@ With the following script [gathered from here](https://gitlab.com/gitlab-com/gl-
|
||||
############################
|
||||
|
||||
for proj in $(gcloud projects list --format="get(projectId)"); do
|
||||
echo "[*] scraping project $proj"
|
||||
for bucket in $(gsutil ls -p $proj); do
|
||||
echo " $bucket"
|
||||
ACL="$(gsutil iam get $bucket)"
|
||||
echo "[*] scraping project $proj"
|
||||
for bucket in $(gsutil ls -p $proj); do
|
||||
echo " $bucket"
|
||||
ACL="$(gsutil iam get $bucket)"
|
||||
|
||||
all_users="$(echo $ACL | grep allUsers)"
|
||||
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"
|
||||
all_users="$(echo $ACL | grep allUsers)"
|
||||
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"
|
||||
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $bucket"
|
||||
fi
|
||||
if [ -z "$all_users" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all users: $bucket"
|
||||
fi
|
||||
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $bucket"
|
||||
fi
|
||||
done
|
||||
if [ -z "$all_auth" ]
|
||||
then
|
||||
:
|
||||
else
|
||||
echo "[!] Open to all authenticated users: $bucket"
|
||||
fi
|
||||
done
|
||||
done
|
||||
```
|
||||
|
||||
{{#include ../../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,35 +1,29 @@
|
||||
# GCP - Public Buckets Privilege Escalation
|
||||
# GCP - Privilegieneskalation bei öffentlichen Buckets
|
||||
|
||||
{{#include ../../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Buckets Privilege Escalation
|
||||
## Privilegieneskalation bei Buckets
|
||||
|
||||
If the bucket policy allowed either “allUsers” or “allAuthenticatedUsers” to **write to their bucket policy** (the **storage.buckets.setIamPolicy** permission)**,** then anyone can modify the bucket policy and grant himself full access.
|
||||
Wenn die Bucket-Richtlinie entweder „allUsers“ oder „allAuthenticatedUsers“ erlaubte, **in ihre Bucket-Richtlinie zu schreiben** (die **storage.buckets.setIamPolicy** Berechtigung)**,** dann kann jeder die Bucket-Richtlinie ändern und sich selbst vollen Zugriff gewähren.
|
||||
|
||||
### Check Permissions
|
||||
### Berechtigungen überprüfen
|
||||
|
||||
There are 2 ways to check the permissions over a bucket. The first one is to ask for them by making a request to `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam` or running `gsutil iam get gs://BUCKET_NAME`.
|
||||
Es gibt 2 Möglichkeiten, die Berechtigungen für einen Bucket zu überprüfen. Die erste besteht darin, sie anzufordern, indem man eine Anfrage an `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam` stellt oder `gsutil iam get gs://BUCKET_NAME` ausführt.
|
||||
|
||||
However, if your user (potentially belonging to allUsers or allAuthenticatedUsers") doesn't have permissions to read the iam policy of the bucket (storage.buckets.getIamPolicy), that won't work.
|
||||
Wenn Ihr Benutzer (potenziell zu "allUsers" oder "allAuthenticatedUsers" gehörend) jedoch keine Berechtigungen hat, um die IAM-Richtlinie des Buckets zu lesen (storage.buckets.getIamPolicy), wird das nicht funktionieren.
|
||||
|
||||
The other option which will always work is to use the testPermissions endpoint of the bucket to figure out if you have the specified permission, for example accessing: `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam/testPermissions?permissions=storage.buckets.delete&permissions=storage.buckets.get&permissions=storage.buckets.getIamPolicy&permissions=storage.buckets.setIamPolicy&permissions=storage.buckets.update&permissions=storage.objects.create&permissions=storage.objects.delete&permissions=storage.objects.get&permissions=storage.objects.list&permissions=storage.objects.update`
|
||||
Die andere Option, die immer funktioniert, besteht darin, den testPermissions-Endpunkt des Buckets zu verwenden, um herauszufinden, ob Sie die angegebene Berechtigung haben, zum Beispiel durch den Zugriff auf: `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam/testPermissions?permissions=storage.buckets.delete&permissions=storage.buckets.get&permissions=storage.buckets.getIamPolicy&permissions=storage.buckets.setIamPolicy&permissions=storage.buckets.update&permissions=storage.objects.create&permissions=storage.objects.delete&permissions=storage.objects.get&permissions=storage.objects.list&permissions=storage.objects.update`
|
||||
|
||||
### Escalating
|
||||
|
||||
In order to grant `Storage Admin` to `allAuthenticatedUsers` it's possible to run:
|
||||
### Eskalation
|
||||
|
||||
Um `Storage Admin` für `allAuthenticatedUsers` zu gewähren, ist es möglich, Folgendes auszuführen:
|
||||
```bash
|
||||
gsutil iam ch allAuthenticatedUsers:admin gs://BUCKET_NAME
|
||||
```
|
||||
|
||||
Another attack would be to **remove the bucket an d recreate it in your account to steal th ownership**.
|
||||
Ein weiterer Angriff wäre es, **den Bucket zu entfernen und ihn in Ihrem Konto neu zu erstellen, um die Eigentümerschaft zu stehlen**.
|
||||
|
||||
## References
|
||||
|
||||
- [https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/](https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/)
|
||||
|
||||
{{#include ../../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user