Google Cloud Platform

Understand GCP

Here is a fun way to grasp the core concepts of GCP (thanks Ygor Cappai for putting all the images in on PDF).

Source: Nettitude

Man In the Middle Attack
Access Level Control (Leveraging Permissive IAM Roles and Permissions, Lack of Role-Based Access Controls (RBAC), ...)
- Enumerate access to Cloud Services for the current IAM role
- Create new Cloud users
- Extract credentials from metadata, configuration files, environment variables, and logs
- Clone databases and instances to access information stored in snapshots
Misconfigured In-bound ports
Over permissive Storage Buckets
Logging and Monitoring
Try to Escape from the GCP sandbox environment
Try to exploit publicly Exposed Services (access keys, tokens, buckets, ...)
Check for the usual user creds compromission (cred stuffing, password spray, ...)

If you are in restricted environment and can not install any other tools you can check out GCP IAM Analyzer
- gcloud asset analyze-iam-policy --organization="123456" --permissions="iam.serviceAccounts.actAS, iam.serviceAccounts.getAccessToken, iam.serviceAccounts.getOpenIdToken, Iam.serviceAccounts.implicitDelegation, iam.serviceAccounts.signBlob, iam.serviceAccounts.signJwt" find all members that can impersonate a service account from the Organization level
gcploit
IAAS permission mining
Hayat
GCP Firewall Enum - Generate targeted port scans for Compute Instances exposed to the internet
GCP Enum - Most of the enumeration commands in this blog, consolidated to a single script
GCP misc - Various tools for attacking GCP environments

Last updated 1 year ago