Secure Reverse-Shell for debug Cloudbuild CI/CD

debug-cloudbuild-cicd.md

Motivation

When attempting to debug an issue, it can be challenging to reproduce the problem on the machine used in the CI/CD process, especially if it is different from the local development environment. Because there is no direct access to the runner machine in cloudbuild, there is alternative way by applying the reverse-shell method that allows gaining access to the CI/CD environment.

Note: Establishing a reverse shell should only be done for the purpose of debugging and testing and not to be misused.

On client (can be accessed from public)

$ sudo apt-get install rlwrap # readline wrapper for nice tty
$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
$ rlwrap openssl s_server -quiet -key key.pem -cert cert.pem -port 4444
### Wait after the connection has been established, then upgrade the shell to fully interactive tty
$ python3 -c "import pty; pty.spawn('/bin/bash')"
root@49662e972571:/workspace# dmidecode -s system-product-name | grep "Google Compute Engine"
Google Compute Engine

On target / cloudbuild machine

In cloudbuild.yml

- id: Reverse shell
  name: ubuntu
  entrypoint: bash
  args:
    - "-c"
    - |-
      apt-get update
      apt-get install python3 openssl -y
      mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -connect <CLIENT_IP>:4444 > /tmp/s; rm /tmp/s