HackTricks Cloud
HackTricks Training Twitter Linkedin Sponsor

GCP - Logging Enum

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Basic Information

This service allows users to store, search, analyze, monitor, and alert on log data and events from GCP.

Cloud Logging is fully integrated with other GCP services, providing a centralized repository for logs from all your GCP resources. It automatically collects logs from various GCP services like App Engine, Compute Engine, and Cloud Functions. You can also use Cloud Logging for applications running on-premises or in other clouds by using the Cloud Logging agent or API.

Key Features:

  • Log Data Centralization: Aggregate log data from various sources, offering a holistic view of your applications and infrastructure.

  • Real-time Log Management: Stream logs in real time for immediate analysis and response.

  • Powerful Data Analysis: Use advanced filtering and search capabilities to sift through large volumes of log data quickly.

  • Integration with BigQuery: Export logs to BigQuery for detailed analysis and querying.

  • Log-based Metrics: Create custom metrics from your log data for monitoring and alerting.

Logs flow

Basically the sinks and log based metrics will device where a log should be stored.

Configurations Supported by GCP Logging

Cloud Logging is highly configurable to suit diverse operational needs:

  1. Log Buckets (Logs storage in the web): Define buckets in Cloud Logging to manage log retention, providing control over how long your log entries are retained.

    • By default the buckets _Default and _Required are created (one is logging what the other isn’t).

      • _Required is:

        LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")

    • Retention period of the data is configured per bucket and must be at least 1 day. However the retention period of _Required is 400 days and cannot be modified.

    • Note that Log Buckets are not visible in Cloud Storage.

  2. Log Sinks (Log router in the web): Create sinks to export log entries to various destinations such as Pub/Sub, BigQuery, or Cloud Storage based on a filter.

    • By default sinks for the buckets _Default and _Required are created:

    • _Required  logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Required  LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
_Default   logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Default   NOT LOG_ID("cloudaudit.googleapis.com/activity") AND NOT LOG_ID("externalaudit.googleapis.com/activity") AND NOT LOG_ID("cloudaudit.googleapis.com/system_event") AND NOT LOG_ID("externalaudit.googleapis.com/system_event") AND NOT LOG_ID("cloudaudit.googleapis.com/access_transparency") AND NOT LOG_ID("externalaudit.googleapis.com/access_transparency")

    • Exclusion Filters: It's possible to set up exclusions to prevent specific log entries from being ingested, saving costs, and reducing unnecessary noise.

  3. Log-based Metrics: Configure custom metrics based on the content of logs, allowing for alerting and monitoring based on log data.

  4. Log views: Log views give advanced and granular control over who has access to the logs within your log buckets.

    • Cloud Logging automatically creates the _AllLogs view for every bucket, which shows all logs. Cloud Logging also creates a view for the _Default bucket called _Default. The _Default view for the _Default bucket shows all logs except Data Access audit logs. The _AllLogs and _Default views are not editable.

It's possible to allow a principal only to use a specific Log view with an IAM policy like:

{
  "bindings": [
    {
      "members": [
        "user:username@gmail.com"
      ],
      "role": "roles/logging.viewAccessor",
      "condition": {
          "title": "Bucket reader condition example",
          "description": "Grants logging.viewAccessor role to user username@gmail.com for the VIEW_ID log view.",
          "expression":
            "resource.name == \"projects/PROJECT_ID/locations/LOCATION/buckets/BUCKET_NAME/views/VIEW_ID\""
      }
    }
  ],
  "etag": "BwWd_6eERR4=",
  "version": 3
}

Default Logs

By default Admin Write operations (also called Admin Activity audit logs) are the ones logged (write metadata or configuration information) and can't be disabled.

Then, the user can enable Data Access audit logs, these are Admin Read, Data Write and Data Write.

You can find more info about each type of log in the docs: https://cloud.google.com/iam/docs/audit-logging

However, note that this means that by default GetIamPolicy actions and other read actions are not being logged. So, by default an attacker trying to enumerate the environment won't be caught if the sysadmin didn't configure to generate more logs.

To enable more logs in the console the sysadmin needs to go to https://console.cloud.google.com/iam-admin/audit and enable them. There are 2 different options:

  • Default Configuration: It's possible to create a default configuration and log all the Admin Read and/or Data Read and/or Data Write logs and even add exempted principals:

  • Select the services: Or just select the services you would like to generate logs and the type of logs and the excepted principal for that specific service.

Also note that by default only those logs are being generated because generating more logs will increase the costs.

Enumeration

The gcloud command-line tool is an integral part of the GCP ecosystem, allowing you to manage your resources and services. Here's how you can use gcloud to manage your logging configurations and access logs.

# List buckets
gcloud logging buckets list
gcloud logging buckets describe <bucket-name> --location <location>

# List log entries: only logs that contain log entries are listed.
gcloud logging logs list

# Get log metrics
gcloud logging metrics list
gcloud logging metrics describe <metric-name>

# Get log sinks
gcloud logging sinks list
gcloud logging sinks describe <sink-name>

# Get log views
gcloud logging views list --bucket <bucket> --location global
gcloud logging views describe --bucket <bucket> --location global <view-id> # view-id is usually the same as the bucket name

# Get log links
gcloud logging links list --bucket _Default --location global
gcloud logging links describe <link-id> --bucket _Default --location global

Example to check the logs of cloudresourcemanager (the one used to BF permissions): https://console.cloud.google.com/logs/query;query=protoPayload.serviceName%3D%22cloudresourcemanager.googleapis.com%22;summaryFields=:false:32:beginning;cursorTimestamp=2024-01-20T00:07:14.482809Z;startTime=2024-01-01T11:12:26.062Z;endTime=2024-02-02T17:12:26.062Z?authuser=2&project=digital-bonfire-410512

There aren't logs of testIamPermissions:

Post Exploitation

pageGCP - Logging Post Exploitation

Persistence

pageGCP - Logging Persistence

References

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

PreviousGCP - KMS EnumNextGCP - Memorystore Enum

Last updated