grte-shamooo

[shamo0]

This PR adds two new files documenting enumeration and privilege escalation techniques for GCP Dataproc:

gcp_dataproc_enum.md: Covers techniques to enumerate Dataproc clusters, jobs, service accounts, and metadata tokens for gathering sensitive information.
gcp_dataproc_privesc.md: Explains how roles like dataproc.editor and dataproc.admin can be exploited for privilege escalation, including token leakage and job-based attacks.

[shamo0]

The specific permission that is being used in privesc is dataproc.jobs.create

[carlospolop]

Hi @shamo0 !

Could you add on each privilege escalation technique in the PR all the granular permissions needed instead of the roles?

[shamo0]

In order to steal the metadata token, the SA needs to have permissions to copy the file to a GCP bucket and create a dataproc job.
The following permissions were give to the SA for the PoC

• dataproc.clusters.get
• dataproc.clusters.use
• dataproc.jobs.create
• dataproc.jobs.get
• dataproc.jobs.list
• storage.objects.create
• storage.objects.get
• storage.objects.list

[carlospolop]

Thanks!

[shamo0]

@carlospolop does this qualify as extra points PR? 👀