Before start pentesting a GCP environment there are a few basics things you need to know about how AWS works to help you understand what you need to do, how to find misconfigurations and how to exploit them.
Concepts such as organization hierarchy, permissions and other basic concepts are explained in:
In order to audit a GCP environment it's very important to know: which services are being used, what is being exposed, who has access to what, and how are internal GCP services an external services connected.
From a Red Team point of view, the first step to compromise a GCP environment is to manage to obtain some credentials. Here you have some ideas on how to do that:
- Leaks in github (or similar) - OSINT
- Password reuse (password leaks)
- 3rd parties breached
- Internal Employee
Or by compromising an unauthenticated service exposed:
Or if you are doing a review you could just ask for credentials with these roles:
For more information about how to enumerate GCP metadata check the following hacktricks page:
In GCP you can try several options to try to guess who you are:
#If you are inside a compromise machine
gcloud auth list
curl -H "Content-Type: application/x-www-form-urlencoded" -d "access_token=$(gcloud auth print-access-token)" https://www.googleapis.com/oauth2/v1/tokeninfo
gcloud auth print-identity-token #Get info from the token
#If you compromised a metadata token or somehow found an OAuth token
curl -H "Content-Type: application/x-www-form-urlencoded" -d "access_token=<token>" https://www.googleapis.com/oauth2/v1/tokeninfo
gcloud organizations list # Get organizations
gcloud resource-manager folders list --organization <org_number> # Get folders
gcloud projects list # Get projects
If you have enough permissions checking the privileges of each entity inside the GCP account will help you understand what you and other identities can do and how to escalate privileges.
If you don't have enough permissions to enumerate IAM, you can steal brute-force them to figure them out. Check how to do the numeration and brute-forcing in:
With the permissions
serviceusage.services.useit's possible to enable services in a project and use them. You could enable the service
cloudidentity.googleapli.comif disabled and user it to enumerate groups (like it's done in PurplePanda in here):
gcloud services enable cloudidentity.googleapis.com
You could also enable the admin service and if you user has enough privileges in Workspace you could enumerate all groups with:
gcloud services enable admin.googleapis.com
gcloud beta identity groups preview --customer <workspace-id>
GCP has an astonishing amount of services, in the following page you will find basic information, enumeration cheatsheets, how to avoid detection, obtain persistence, and other post-exploitation tricks about some of them:
Moreover, in this stage you might discovered more services exposed to unauthenticated users, you might be able to exploit them:
The most common way once you have obtained some cloud credentials or have compromised some service running inside a cloud is to abuse misconfigured privileges the compromised account may have. So, the first thing you should do is to enumerate your privileges.
Moreover, during this enumeration, remember that permissions can be set at the highest level of "Organization" as well.
While enumerating GCP services you might have found some of them exposing elements to the Internet (VM/Containers ports, databases or queue services, snapshots or buckets...). As pentester/red teamer you should always check if you can find sensitive information / vulnerabilities on them as they might provide you further access into the AWS account.
In this book you should find information about how to find exposed AWS services and how to check them. About how to find vulnerabilities in exposed network services I would recommend you to search for the specific service in:
- In the GCloud console, in https://console.cloud.google.com/iam-admin/asset-inventory/dashboard you can see resources and IAMs being used by project.
git clone https://github.com/google/gcp_scanner.git
virtualenv -p python3 venv
pip install -r requirements.txt
# Execute with gcloud creds
python3 __main__.py -o /tmp/output/ -g "$HOME/.config/gcloud"
Remember that you can use the parameter
gcloudcli to print the requests the tool is performing. If you don't want the logs to redact the token value use
gcloud config set log_http_redact_token false
Moreover, to intercept the communication:
gcloud config set proxy/address 127.0.0.1
gcloud config set proxy/port 8080
gcloud config set proxy/type http
gcloud config set auth/disable_ssl_validation True
# If you don't want to completely disable ssl_validation use:
gcloud config set core/custom_ca_certs_file cert.pem
# Back to normal
gcloud config unset proxy/address
gcloud config unset proxy/port
gcloud config unset proxy/type
gcloud config unset auth/disable_ssl_validation
gcloud config unset core/custom_ca_certs_file