gcp-secretmanager-privesc.md

GCP - Secretmanager Privesc

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

secretmanager

For more information about secretmanager:

{% content-ref url="../gcp-services/gcp-secrets-manager-enum.md" %} gcp-secrets-manager-enum.md {% endcontent-ref %}

secretmanager.versions.access

This give you access to read the secrets from the secret manager and maybe this could help to escalate privielegs (depending on which information is sotred inside the secret):

# Get clear-text of version 1 of secret: "<secret name>"
gcloud secrets versions access 1 --secret="<secret_name>"

As this is also a post exploitation technique it can be found in:

{% content-ref url="../gcp-post-exploitation/gcp-secretmanager-post-exploitation.md" %} gcp-secretmanager-post-exploitation.md {% endcontent-ref %}

secretmanager.secrets.setIamPolicy

This give you access to give you access to read the secrets from the secret manager, like using:

gcloud secrets add-iam-policy-binding <scret-name> \
  --member="serviceAccount:<sa-name>@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}