GCP - Storage Unauthenticated Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Storage

Storage에 대한 자세한 정보는 다음을 확인하세요:

GCP - Storage Enum

Public Bucket Brute Force

버킷에 접근하기 위한 URL 형식은 **https://storage.googleapis.com/<bucket-name>**입니다.

다음 도구를 사용하여 주어진 이름의 변형을 생성하고 잘못 구성된 버킷을 검색할 수 있습니다:

• https://github.com/RhinoSecurityLabs/GCPBucketBrute

또한 언급된 도구는 다음에서 확인할 수 있습니다:

GCP - Unauthenticated Enum & Access

버킷에 접근할 수 있는 경우 더 승격할 수 있는지 확인하세요:

GCP - Public Buckets Privilege Escalation

Search Open Buckets in Current Account

다음 스크립트 여기에서 수집됨을 사용하여 모든 열린 버킷을 찾을 수 있습니다:

#!/bin/bash

############################
# Run this tool to find buckets that are open to the public anywhere
# in your GCP organization.
#
# Enjoy!
############################

for proj in $(gcloud projects list --format="get(projectId)"); do
echo "[*] scraping project $proj"
for bucket in $(gsutil ls -p $proj); do
echo "    $bucket"
ACL="$(gsutil iam get $bucket)"

all_users="$(echo $ACL | grep allUsers)"
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"

if [ -z "$all_users" ]
then
:
else
echo "[!] Open to all users: $bucket"
fi

if [ -z "$all_auth" ]
then
:
else
echo "[!] Open to all authenticated users: $bucket"
fi
done
done

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• 해킹 트릭을 공유하려면 HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하세요.