GWS - Workspace Sync Attacks (GCPW, GCDS, GPS, Directory Sync with AD & EntraID)
GCPW - Google Credential Provider for Windows
This is the single sign-on that Google Workspaces provides so users can login in their Windows PCs using their Workspace credentials. Moreover, this will store tokens to access Google Workspace in some places in the PC: Disk, memory & the registry... it's even possible to obtain the clear text password.
Note that Winpeas is capable to detect GCPW, get information about the configuration and even tokens.
Find more information about this in:
GCPW - Google Credential Provider for WindowsGCSD - Google Cloud Directory Sync
This is a tool that can be used to sync your active directory users and groups to your Workspace (and not the other way around by the time of this writing).
It's interesting because it's a tool that will require the credentials of a Workspace superuser and privileged AD user. So, it might be possible to find it inside a domain server that would be synchronising users from time to time.
Note that Winpeas is capable to detect GCDS, get information about the configuration and even the passwords and encrypted credentials.
Find more information about this in:
GCDS - Google Cloud Directory SyncGPS - Google Password Sync
This is the binary and service that Google offers in order to keep synchronized the passwords of the users between the AD and Workspace. Every-time a user changes his password in the AD, it's set to Google.
It gets installed in C:\Program Files\Google\Password Sync where you can find the binary PasswordSync.exe to configure it and password_sync_service.exe (the service that will continue running).
Note that Winpeas is capable to detect GPS, get information about the configuration and even the passwords and encrypted credentials.
Find more information about this in:
GPS - Google Password SyncAdmin Directory Sync
The main difference between this way to synchronize users with GCDS is that GCDS is done manually with some binaries you need to download and run while Admin Directory Sync is serverless managed by Google in https://admin.google.com/ac/sync/externaldirectories.
Find more information about this in:
GWS - Admin Directory SyncLast updated
