Cloud Storage

Description

Cloud Storage [Misc]

Have you heard about this "cloud" thing that everyone is using? I think we can save a bunch of money by putting our cat photos there!

I have provided a service account key that you can use to authenticate and check that you can access the photos.

That service account shouldn't have access to anything other than the cat pictures, but this whole "eye aye em" thing is a bit confusing, so I'm not entirely sure!

We can't afford to have another data breach, so we need to be confident that our flags are secure before we make the switch.

lateral-replica-423406-n3-f892e5bfb33b.jsonarrow-up-right

Solution

The json file seems to be related to Google Cloud storage:

{
    "type": "service_account",
    "project_id": "lateral-replica-423406-n3",
    "private_key_id": "f892e5bfb33b5c946945b97c8827fe7fae7e00e5",
    "private_key": "-----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----\n",
    "client_email": "user-service-account@lateral-replica-423406-n3.iam.gserviceaccount.com",
    "client_id": "105437552107326132543",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/user-service-account%40lateral-replica-423406-n3.iam.gserviceaccount.com",
    "universe_domain": "googleapis.com"
}

Using gcloud CLI load the key and authenticate for access:

List buckets:

List files:

We get access denied when trying to copy the flag...

We do have access to the other bucket so something else is required to access flag.

Get IAM policy on bucket:

The only diff seems to be viewer role:Cloud Storage

circle-info

Note: Left is flag bucket, right is cat-pictures bucket IAM policy

Get accounts:

List roles:

Describe roles:

Impersonate the admin and get auth token:https://cloud.hacktricks.xyz/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc#iam.serviceaccounts.getaccesstoken-iam.serviceaccounts.getarrow-up-right

circle-info

Note: The file url came from gsutil cat gs://uscg-2024-bgr-flags/flag.txt command as it shows resource it tried to access!

circle-check

Resources used:

PPS: This challenge was more discovery rather goto solution, first time encounter with gcloud platform CTF. Do be fun, but commands do be messed up in order D:

Last updated