GCP - Artifact Registry Privesc

Reading time: 6 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Artifact Registry

Kwa maelezo zaidi kuhusu Artifact Registry angalia:

GCP - Artifact Registry Enum

artifactregistry.repositories.uploadArtifacts

Kwa ruhusa hii mshambuliaji anaweza kupakia toleo jipya la artefacts zenye msimbo mbaya kama picha za Docker:

bash

# Configure docker to use gcloud to authenticate with Artifact Registry
gcloud auth configure-docker <location>-docker.pkg.dev

# tag the image to upload it
docker tag <local-img-name>:<local-tag> <location>-docker.pkg.dev/<proj-name>/<repo-name>/<img-name>:<tag>

# Upload it
docker push <location>-docker.pkg.dev/<proj-name>/<repo-name>/<img-name>:<tag>

caution

Ilijulikana kwamba ni uwezekano wa kupakia picha mpya ya docker mbaya yenye jina na tag sawa na ile iliyopo, hivyo ya zamani itapoteza tag na wakati picha hiyo yenye tag hiyo itakaposhushwa, picha mbaya itashushwa.

Pakia maktaba ya Python

Anza kwa kuunda maktaba ya kupakia (ikiwa unaweza kushusha toleo la hivi karibuni kutoka kwenye registry unaweza kuepuka hatua hii):

Weka muundo wa mradi wako:

Unda directory mpya kwa ajili ya maktaba yako, e.g., hello_world_library.
Ndani ya directory hii, unda directory nyingine yenye jina la pakiti yako, e.g., hello_world.
Ndani ya directory ya pakiti yako, unda faili __init__.py. Faili hii inaweza kuwa tupu au inaweza kuwa na mwanzo wa pakiti yako.

bash

mkdir hello_world_library
cd hello_world_library
mkdir hello_world
touch hello_world/__init__.py

Andika msimbo wa maktaba yako:

Ndani ya directory ya hello_world, unda faili mpya ya Python kwa ajili ya moduli yako, e.g., greet.py.
Andika kazi yako ya "Hello, World!":

python

# hello_world/greet.py
def say_hello():
return "Hello, World!"

Unda faili setup.py:

Katika mzizi wa directory yako ya hello_world_library, unda faili setup.py.
Faili hii ina metadata kuhusu maktaba yako na inamwambia Python jinsi ya kuisakinisha.

python

# setup.py
from setuptools import setup, find_packages

setup(
name='hello_world',
version='0.1',
packages=find_packages(),
install_requires=[
# Mahitaji yoyote ambayo maktaba yako inahitaji
],
)

Sasa, hebu tupakie maktaba:

Jenga pakiti yako:

Kutoka mzizi wa directory yako ya hello_world_library, endesha:

python3 setup.py sdist bdist_wheel

Sanidi uthibitisho kwa twine (inayotumika kupakia pakiti yako):

Hakikisha una twine iliyosakinishwa (pip install twine).
Tumia gcloud kusanidi akreditif:

```
twine upload --username 'oauth2accesstoken' --password "$(gcloud auth print-access-token)" --repository-url https://<location>-python.pkg.dev/<project-id>/<repo-name>/ dist/*
```
```
3. **Safisha ujenzi**
<div class="codeblock_filename_container"><span class="codeblock_filename_inner hljs">bash</span></div>

```bash
rm -rf dist build hello_world.egg-info
```
</details>

<div class="mdbook-alerts mdbook-alerts-caution">
<p class="mdbook-alerts-title">
  <span class="mdbook-alerts-icon"></span>
  caution
</p>


Haiwezekani kupakia maktaba ya python yenye toleo sawa na ile iliyopo tayari, lakini inawezekana kupakia **matoleo makubwa zaidi** (au kuongeza **`.0` mwishoni** mwa toleo ikiwa hiyo inafanya kazi - sio katika python ingawa-), au **kufuta toleo la mwisho na kupakia jipya** (inahitajika `artifactregistry.versions.delete)`**:**

```sh
gcloud artifacts versions delete <version> --repository=<repo-name> --location=<location> --package=<lib-name>
```

</div>


### `artifactregistry.repositories.downloadArtifacts`

Kwa ruhusa hii unaweza **kupakua artefacts** na kutafuta **taarifa nyeti** na **udhaifu**.

Pakua picha ya **Docker**:
<div class="codeblock_filename_container"><span class="codeblock_filename_inner hljs">sh</span></div>

```sh
# Configure docker to use gcloud to authenticate with Artifact Registry
gcloud auth configure-docker <location>-docker.pkg.dev

# Dowload image
docker pull <location>-docker.pkg.dev/<proj-name>/<repo-name>/<img-name>:<tag>
```
Pakua maktaba ya **python**:
<div class="codeblock_filename_container"><span class="codeblock_filename_inner hljs">bash</span></div>

```bash
pip install <lib-name> --index-url "https://oauth2accesstoken:$(gcloud auth print-access-token)@<location>-python.pkg.dev/<project-id>/<repo-name>/simple/" --trusted-host <location>-python.pkg.dev --no-cache-dir
```
- Nini kinatokea ikiwa registries za mbali na za kawaida zimeshikwa katika moja ya virtual na pakiti ipo katika zote mbili? Angalia ukurasa huu:

<a class="content_ref" href="../gcp-persistence/gcp-artifact-registry-persistence.md"><span class="content_ref_label">GCP - Artifact Registry Persistence</span></a>

### `artifactregistry.tags.delete`, `artifactregistry.versions.delete`, `artifactregistry.packages.delete`, (`artifactregistry.repositories.get`, `artifactregistry.tags.get`, `artifactregistry.tags.list`)

Futa artifacts kutoka kwenye registry, kama picha za docker:
<div class="codeblock_filename_container"><span class="codeblock_filename_inner hljs">bash</span></div>

```bash
# Delete a docker image
gcloud artifacts docker images delete <location>-docker.pkg.dev/<proj-name>/<repo-name>/<img-name>:<tag>
```
### `artifactregistry.repositories.delete`

Futa hifadhi kamili (hata kama ina maudhui):
```
gcloud artifacts repositories delete <repo-name> --location=<location>
```
### `artifactregistry.repositories.setIamPolicy`

Mshambuliaji mwenye ruhusa hii anaweza kujipa ruhusa za kufanya baadhi ya mashambulizi ya hifadhi yaliyotajwa hapo awali.

### Pivoting to other Services through Artifact Registry Read & Write

- **Cloud Functions**

Wakati Cloud Function inaundwa, picha mpya ya docker inasukumwa kwenye Artifact Registry ya mradi. Nilijaribu kubadilisha picha hiyo na nyingine mpya, na hata kufuta picha ya sasa (na picha ya `cache`) na hakuna kilichobadilika, cloud function inaendelea kufanya kazi. Hivyo, labda **inaweza kuwa inawezekana kutumia shambulio la Race Condition** kama ilivyo na ndoo kubadilisha kontena la docker litakalotekelezwa lakini **kubadilisha picha iliyohifadhiwa pekee hakuwezekani kuathiri Cloud Function**.

- **App Engine**

Ingawa App Engine inaunda picha za docker ndani ya Artifact Registry. Ilijaribiwa kwamba **hata ukibadilisha picha ndani ya huduma hii** na kuondoa mfano wa App Engine (hivyo mfano mpya unapelekwa) **kanuni inayotekelezwa haibadiliki**.\
Inaweza kuwa inawezekana kwamba kufanya **shambulio la Race Condition kama ilivyo na ndoo inaweza kuwa inawezekana kufuta kanuni inayotekelezwa**, lakini hii haijajaribiwa.

<div class="mdbook-alerts mdbook-alerts-tip">
<p class="mdbook-alerts-title">
  <span class="mdbook-alerts-icon"></span>
  tip
</p>


Jifunze na fanya mazoezi ya AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
Jifunze na fanya mazoezi ya Azure Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://training.hacktricks.xyz/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">

<details>

<summary>Support HackTricks</summary>

- Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
- **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
- **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

</div>