mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 07:29:04 -08:00
131 lines
7.1 KiB
Markdown
131 lines
7.1 KiB
Markdown
# GCP - Containers & GKE Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Containers
|
|
|
|
In GCP containers you can find most of the containers based services GCP offers, here you can see how to enumerate the most common ones:
|
|
|
|
```bash
|
|
gcloud container images list
|
|
gcloud container images list --repository us.gcr.io/<project-name> #Search in other subdomains repositories
|
|
gcloud container images describe <name>
|
|
gcloud container subnets list-usable
|
|
gcloud container clusters list
|
|
gcloud container clusters describe <name>
|
|
gcloud container clusters get-credentials [NAME]
|
|
|
|
# Run a container locally
|
|
docker run --rm -ti gcr.io/<project-name>/secret:v1 sh
|
|
|
|
# Login & Download
|
|
sudo docker login -u oauth2accesstoken -p $(gcloud auth print-access-token) https://HOSTNAME
|
|
## where HOSTNAME is gcr.io, us.gcr.io, eu.gcr.io, or asia.gcr.io.
|
|
sudo docker pull HOSTNAME/<project-name>/<image-name>
|
|
```
|
|
|
|
### Privesc
|
|
|
|
In the following page you can check how to **abuse container permissions to escalate privileges**:
|
|
|
|
{% content-ref url="../gcp-privilege-escalation/gcp-container-privesc.md" %}
|
|
[gcp-container-privesc.md](../gcp-privilege-escalation/gcp-container-privesc.md)
|
|
{% endcontent-ref %}
|
|
|
|
## Node Pools
|
|
|
|
These are the pool of machines (nodes) that form the kubernetes clusters.
|
|
|
|
```bash
|
|
# Pool of machines used by the cluster
|
|
gcloud container node-pools list --zone <zone> --cluster <cluster>
|
|
gcloud container node-pools describe --cluster <cluster> --zone <zone> <node-pool>
|
|
```
|
|
|
|
## Kubernetes
|
|
|
|
For information about what is Kubernetes check this page:
|
|
|
|
{% content-ref url="../../kubernetes-security/" %}
|
|
[kubernetes-security](../../kubernetes-security/)
|
|
{% endcontent-ref %}
|
|
|
|
First, you can check to see if any Kubernetes clusters exist in your project.
|
|
|
|
```
|
|
gcloud container clusters list
|
|
```
|
|
|
|
If you do have a cluster, you can have `gcloud` automatically configure your `~/.kube/config` file. This file is used to authenticate you when you use [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/), the native CLI for interacting with K8s clusters. Try this command.
|
|
|
|
```
|
|
gcloud container clusters get-credentials [CLUSTER NAME] --region [REGION]
|
|
```
|
|
|
|
Then, take a look at the `~/.kube/config` file to see the generated credentials. This file will be used to automatically refresh access tokens based on the same identity that your active `gcloud` session is using. This of course requires the correct permissions in place.
|
|
|
|
Once this is set up, you can try the following command to get the cluster configuration.
|
|
|
|
```
|
|
kubectl cluster-info
|
|
```
|
|
|
|
You can read more about `gcloud` for containers [here](https://cloud.google.com/sdk/gcloud/reference/container/).
|
|
|
|
This is a simple script to enumerate kubernetes in GCP: [https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp\_k8s\_enum](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_k8s_enum)
|
|
|
|
### TLS Boostrap Privilege Escalation
|
|
|
|
Initially this privilege escalation technique allowed to **privesc inside the GKE cluster** effectively allowing an attacker to **fully compromise it**.
|
|
|
|
This is because GKE provides [TLS Bootstrap credentials](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) in the metadata, which is **accessible by anyone by just compromising a pod**.
|
|
|
|
The technique used is explained in the following posts:
|
|
|
|
* [https://www.4armed.com/blog/hacking-kubelet-on-gke/](https://www.4armed.com/blog/hacking-kubelet-on-gke/)
|
|
* [https://www.4armed.com/blog/kubeletmein-kubelet-hacking-tool/](https://www.4armed.com/blog/kubeletmein-kubelet-hacking-tool/)
|
|
* [https://rhinosecuritylabs.com/cloud-security/kubelet-tls-bootstrap-privilege-escalation/](https://rhinosecuritylabs.com/cloud-security/kubelet-tls-bootstrap-privilege-escalation/)
|
|
|
|
Ans this tool was created to automate the process: [https://github.com/4ARMED/kubeletmein](https://github.com/4ARMED/kubeletmein)
|
|
|
|
However, the technique abused the fact that **with the metadata credentials** it was possible to **generate a CSR** (Certificate Signing Request) for a **new node**, which was **automatically approved**.\
|
|
In my test I checked that **those requests aren't automatically approved anymore**, so I'm not sure if this technique is still valid.
|
|
|
|
### Secrets in Kubelet API <a href="#the-kubelet-api-git-secrets-redux" id="the-kubelet-api-git-secrets-redux"></a>
|
|
|
|
In [**this post**](https://blog.assetnote.io/2022/05/06/cloudflare-pages-pt3/) it was discovered it was discovered a Kubelet API address accesible from inside a pod in GKE giving the details of the pods running:
|
|
|
|
```
|
|
curl -v -k http://10.124.200.1:10255/pods
|
|
```
|
|
|
|
Even if the API **doesn't allow to modify resources**, it could be possible to find **sensitive information** in the response. The endpoint /pods was found using [**Kiterunner**](https://github.com/assetnote/kiterunner).
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|