GCP - IAM, Principals & Org Unauthenticated Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Iam & GCP Principals

For more information check:

GCP - IAM, Principals & Org Policies Enum

Is domain used in Workspace?

1. Check DNS records

If it has a google-site-verification record it's probable that it's (or it was) using Workspace:

dig txt hacktricks.xyz

[...]
hacktricks.xyz.		3600	IN	TXT	"google-site-verification=2mWyPXMPXEEy6QqWbCfWkxFTcQhyYdwHrOxee1Yeo-0"
hacktricks.xyz.		3600	IN	TXT	"google-site-verification=C19PtLcZ1EGyzUYYJTX1Tp6bOGessxzN9gqE-SVKhRA"
hacktricks.xyz.		300	IN	TXT	"v=spf1 include:usb._netblocks.mimecast.com include:_spf.google.com include:_spf.psm.knowbe4.com include:_spf.salesforce.com include:spf.mandrillapp.com ~all"

If something like include:_spf.google.com also appears it confirms it (note that if it doesn't appear it doesn't denies it as a domain can be in Workspace without using gmail as mail provider).

2. Try to setup a Workspace with that domain

Another option is to try to setup a Workspace using the domain, if it complains that the domain is already used (like in the image), you know it's already used!

To try to setup a Workspace domain follow: https://workspace.google.com/business/signup/welcome

3. Try to recover the password of an email using that domain

If you know any valid email address being use din that domain (like: [e-mail] or [e-mail]) you can try to recover the account in https://accounts.google.com/signin/v2/recoveryidentifier, and if try doesn't shows an error indicating that Google has no idea about that account, then it's using Workspace.

Enumerate emails and service accounts

It's possible to enumerate valid emails of a Workspace domain and SA emails by trying to assign them permissions and checking the error messages. For this you just need to have permissions to assign permission to a project (which can be just owned by you).

Note that to check them but even if they exist not grant them a permission you can use the type serviceAccount when it's an user and user when it's a SA:

# Try to assign permissions to user '[e-mail]'
# but indicating it's a service account
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
  --member='serviceAccount:[e-mail]' \
  --role='roles/viewer'
## Response:
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User [e-mail] does not exist.

# Now try with a valid email
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
  --member='serviceAccount:[e-mail]' \
  --role='roles/viewer'
# Response:
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal [e-mail] is of type "user". The principal should appear as "user:[e-mail]". See https://cloud.google.com/iam/help/members/types for additional documentation.

A faster way to enumerate Service Accounts in know projects is just to try to access to the URL: https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email> For examlpe: https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/[e-mail]

If the response is a 403, it means that the SA exists. But if the answer is a 404 it means that it doesn't exist:

// Exists
{
  "error": {
    "code": 403,
    "message": "Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.",
    "status": "PERMISSION_DENIED"
  }
}

// Doesn't exist
{
  "error": {
    "code": 404,
    "message": "Unknown service account",
    "status": "NOT_FOUND"
  }
}

Note how when the user email was valid the error message indicated that they type isn't, so we managed to discover that the email [e-mail] exists without granting it any privileges.

You can so the same with Service Accounts using the type user: instead of serviceAccount::

# Non existent
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
  --member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
  --role='roles/viewer'
# Response
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User <invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com does not exist.

# Existent
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
  --member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
  --role='roles/viewer'
# Response
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal [e-mail] is of type "serviceAccount". The principal should appear as "serviceAccount:[e-mail]". See https://cloud.google.com/iam/help/members/types for additional documentation.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.