gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2025-12-28 13:43:24 -08:00
Code Issues Packages Projects Releases Wiki Activity

actas in cloudbuild

Browse Source
This commit is contained in:
Carlos Polop
2025-01-05 16:03:29 +01:00
parent ec0ff62bcb
commit c1aee098b6
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md
View File

@@ -10,7 +10,7 @@ For more information about Cloud Build check:
../gcp-services/gcp-cloud-build-enum.md
{{#endref}}
### `cloudbuild.builds.create`
### `cloudbuild.builds.create`, `iam.serviceAccounts.actAs`
With this permission you can **submit a cloud build**. The cloudbuild machine will have in it’s filesystem by **default a token of the cloudbuild Service Account**: `<PROJECT_NUMBER>@cloudbuild.gserviceaccount.com`. However, you can **indicate any service account inside the project** in the cloudbuild configuration.\
Therefore, you can just make the machine exfiltrate to your server the token or **get a reverse shell inside of it and get yourself the token** (the file containing the token might change).