gcploit Dataproc start guide?

trafficstars

I think a guide of how to use the dataproc exploit mught be a great addition.

In the defcon talk, the dataproc exploit is started by using an already captured service account. I'm wondering how one might do it from the base service account. When I try I get the following errors:

root@gcptesting:~# gcploit --exploit dataproc --project ripthisproject
Running command:
gcloud auth print-identity-token
Running command:
gcloud dataproc clusters create vptgsggq --region us-central1 --scopes cloud-platform
error code Command '['gcloud', 'dataproc', 'clusters', 'create', 'vptgsggq', '--region', 'us-central1', '--scopes', 'cloud-platform']' returned non-zero exit status 1. b"ERROR: (gcloud.dataproc.clusters.create) INVALID_ARGUMENT: User not authorized to act as service account '[email protected]'. To act as a service account, user must have one of [Owner, Editor, Service Account Actor] roles. See https://cloud.google.com/iam/docs/understanding-service-accounts for additional details.\n"
Running command:
gcloud dataproc jobs submit pyspark --cluster vptgsggq dataproc_job.py --region us-central1
error code Command '['gcloud', 'dataproc', 'jobs', 'submit', 'pyspark', '--cluster', 'vptgsggq', 'dataproc_job.py', '--region', 'us-central1']' returned non-zero exit status 1. b'ERROR: (gcloud.dataproc.jobs.submit.pyspark) NOT_FOUND: Not found: Cluster projects/ripthisproject/regions/us-central1/clusters/vptgsggq\n'
Running command:
gcloud dataproc clusters delete vptgsggq --region us-central1 --quiet
error code Command '['gcloud', 'dataproc', 'clusters', 'delete', 'vptgsggq', '--region', 'us-central1', '--quiet']' returned non-zero exit status 1. b'ERROR: (gcloud.dataproc.clusters.delete) NOT_FOUND: Not found: Cluster projects/ripthisproject/regions/us-central1/clusters/vptgsggq\n'
False
Traceback (most recent call last):
  File "main.py", line 184, in <module>
    main()
  File "main.py", line 180, in main
    identity = dataproc(args.source, args.project)
  File "main.py", line 81, in dataproc
    for line in raw_output.split("\n"):
AttributeError: 'bool' object has no attribute 'split'

The base service account I am using has the Dataproc Admin permission, that's it. It seems like the code is trying to grab the default compute service account instead of using the dataproc admin SA I created. When running the command locally I get the following:

root@gcptesting:~# gcloud dataproc clusters create vptgsggq --region us-central1 --scopes cloud-platform
ERROR: (gcloud.dataproc.clusters.create) INVALID_ARGUMENT: User not authorized to act as service account '[email protected]'. To act as a service account, user must have one of [Owner, Editor, Service Account Actor] roles. See https://cloud.google.com/iam/docs/understanding-service-accounts for additional details.

Also, Cloud Resource Manager API needs to be enabled to list projects, figured this out trying to test on a new project.

Maybe you have to start with an Editor SA and then can move horizontally with a dataproc SA? Sorry if I am missing something.

Aug 07 '20 19:08 danthegoodman1

Hey Dan! Very recently Google has been making a lot of changes as a result of the talk. One of them is around Dataproc. I haven't had time to actually test the new changes, I was under the impression they wouldn't take affect for existing projects until 2021, but here's the full message from them:

actAs changes

Aug 07 '20 20:08 dxa4481

Good to hear,

After running the actAs first, I am now getting the following error:

[email protected]
refreshing cred
refreshing parent
Running command:
gcloud auth print-identity-token
Traceback (most recent call last):
  File "main.py", line 184, in <module>
    main()
  File "main.py", line 180, in main
    identity = dataproc(args.source, args.project)
  File "main.py", line 77, in dataproc
    run_cmd_on_source(source_name, "gcloud dataproc clusters create {} --region us-central1 --scopes cloud-platform".format(cluster_name), project)
  File "main.py", line 123, in run_cmd_on_source
    source.refresh_cred(db_session, base_cf.run_gcloud_command_local, dataproc)
  File "/models.py", line 53, in refresh_cred
    return self.refresh_cred(db_session, run_local)
TypeError: refresh_cred() missing 1 required positional argument: 'dataproc'```
Maybe this was caused by these changes?

Haven't had much time to look deep into the error so I thought I'd bring it up. Love the work and the concept is so cool.

Aug 07 '20 20:08 danthegoodman1

Hmm that one looks like it's trying to create a dataproc cluster which shouldn't happen if you're just using actAs. If some of your SA's were obtained via dataproc exploit then it'll try to refresh those tokens through dataproc, but if you're doing a clean install it shouldn't do that. Try removing the db directory and starting again with jsut the base identity and actAs

Aug 07 '20 20:08 dxa4481

Yeah all the commands I ran were asking for the dataproc positional argument, even gcploit --gcloud "projects list". I've deleted the DB and ran the actas exploit again. Still get the following error:

name='fqsaxyqa', role='unknown', serviceAccount='[email protected]', project='ripthisproject', password='kpazbudz'
name='byujusfm', role='unknown', serviceAccount='[email protected]', project='ripthisproject', password='fzdltpnc'
name='rilzuecs', role='unknown', serviceAccount='[email protected]', project='ripthisproject', password='uzfootcy'
name='mqgeenlm', role='unknown', serviceAccount='[email protected]', project='ripthisproject', password='ziijyemu'
root@gcptesting:~# gcploit --gcloud "projects list" --source byujusfm
[email protected]
refreshing cred
refreshing parent
Running command:
gcloud auth print-identity-token
Traceback (most recent call last):
  File "main.py", line 184, in <module>
    main()
  File "main.py", line 158, in main
    return_output = run_cmd_on_source(args.source, args.gcloud_cmd, args.project)
  File "main.py", line 123, in run_cmd_on_source
    source.refresh_cred(db_session, base_cf.run_gcloud_command_local, dataproc)
  File "/models.py", line 53, in refresh_cred
    return self.refresh_cred(db_session, run_local)
TypeError: refresh_cred() missing 1 required positional argument: 'dataproc'

edit: the actas command runs fine when using the default compute engine account.