diff --git a/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md b/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md index 3acec8a3..ecec8d5f 100644 --- a/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md +++ b/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md @@ -102,7 +102,7 @@ However, **using the cli `bq`** you need some more: **`bigquery.rowAccessPolicie {% code overflow="wrap" %} ```bash -bq query --nouse_legacy_sql 'CREATE OR REPLACE ROW ACCESS POLICY ON `..` GRANT TO ("user:user@email.xyz") FILTER USING (term = "Cfba");' # A example filter was used +bq query --nouse_legacy_sql 'CREATE OR REPLACE ROW ACCESS POLICY ON `..` GRANT TO ("") FILTER USING (term = "Cfba");' # A example filter was used ``` {% endcode %} @@ -116,6 +116,22 @@ It's possible to find the filter ID in the output of the row policies enumeratio apac_filter term = "Cfba" user:asd@hacktricks.xyz 21 Jan 23:32:09 21 Jan 23:32:09 ``` +If you have **`bigquery.rowAccessPolicies.delete`** instead of `bigquery.rowAccessPolicies.update` you could also just delete the policy: + +{% code overflow="wrap" %} +```bash +# Remove one +bq query --nouse_legacy_sql 'DROP ALL ROW ACCESS POLICY ON `..`;' + +# Remove all (if it's the last row policy you need to use this +bq query --nouse_legacy_sql 'DROP ALL ROW ACCESS POLICIES ON `..`;' +``` +{% endcode %} + +{% hint style="danger" %} +Another potential option to bypass row access policies would be to just change the value of the restricted data. If you can only see when `term` is `Cfba`, just modify all the records of the table to have `term = "Cfba"`. However this is prevented by bigquery. +{% endhint %} +
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)! diff --git a/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md b/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md index aadb970f..354b5eab 100644 --- a/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md +++ b/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md @@ -165,7 +165,7 @@ gcloud data-catalog taxonomies get-iam-policy --location= show --format=prettyjson --job=true +bq show --location= show --format=prettyjson --job=true # Misc bq show --encryption_service_account # Get encryption service account