Enumerating GCP Organizations, Projects, and Cloud Storage Buckets

Enumerating GCP organizations, projects, and cloud storage buckets helps attackers view the cloud structure, find all projects, and identify misconfigured or public buckets. This allows them to retrieve valuable data, exploit access control weaknesses, and gain unauthorized access to sensitive information.

The attackers can use the following commands for this purpose:

List Organizations

Run the following command to list organizations accessible by the target user account:

gcloud organizations list

This command displays a comprehensive list of organizations associated with the target user account, along with the organization IDs.

View Folders

Run the following command to view all folders that the user has access within the specified organization:

gcloud resource-manager folders list --organization=<organization_id>

List Projects

Run the following command to identify all active projects in which the current account holds owner, editor, browser, or viewer permission:

gcloud projects list

Enumerating Google Cloud Service Accounts

Enumerating Google Cloud service accounts helps attackers identify accounts and permissions. This reveals high-privileged accounts that target unauthorized access or escalation. Exploiting these factors can lead to infrastructure compromises and data theft.

Attackers can use the following commands to list service accounts in a target Google Cloud account:

List Service Accounts

Run the following command to list all service accounts in the current project:

gcloud iam service-accounts list

Attackers can specify project_id using the --project flag to retrieve detailed information regarding a particular service account.

Find Service Account Roles

Run the following command to find all the roles associated with a service account:

gcloud projects get-iam-policy <project-id>

List Service Accounts

Run the following command to list all service accounts in the current project:

gcloud iam service-accounts list

Attackers can specify project_id using the --project flag to retrieve detailed information regarding a particular service account.

Find Service Account Roles

Run the following command to find all the roles associated with a service account:

gcloud projects get-iam-policy <project-id>

Retrieve Access Token

Run the following command to retrieve the access token for a target account:

gcloud auth print-access-token --account=<service-account-email>

Enumerating Google Cloud Resources

The enumeration of Google Cloud resources, such as Compute Engine and Cloud SQL instances, reveals critical infrastructure details. Attackers can identify virtual machines, operating systems, open ports, network configurations, or publicly accessible services in Compute Engine instances by exploiting weak security settings or outdated software. Cloud SQL instances can identify database versions and access settings targeting weak passwords, excessive permissions, or unpatched vulnerabilities.

Attackers can use the commands listed below to enumerate instances:

List Compute Engine Instances

Run the following command to identify all Compute Engine instances in a project:

gcloud compute instances list

Describe Compute Engine Instance

Run the following command to retrieve all the data associated with a Compute Engine virtual machine instance in a specific zone:

gcloud compute instances describe <instance> --zone <zone>

List Instance Service Accounts

Run the following command to list the service accounts associated with a Compute Engine instance:

gcloud compute instances describe INSTANCE_NAME --zone=<zone> --format="table(serviceAccounts.scopes)"

List SQL Instances

Run the following command to view the SQL instances associated with the current project:

gcloud sql instances list

List SQL Databases

Run the following command to enumerate SQL databases associated with the current project:

gcloud sql databases list --instance=<instance_name>

Enumerating Google Cloud IAM Roles and Policies

By analyzing roles and policies, attackers can find accounts with excessive privileges and misconfigured access controls and understand permission hierarchies. This helps them exploit overprivileged accounts and access sensitive data and resources.

Attackers can use the following commands to enumerate the IAM roles and policies in a targeted Google Cloud environment:

List IAM Roles

Run the following command to list predefined roles or custom roles for an organization or project:

gcloud iam roles list [--show-deleted] [--organization=<organization>] [--project=<project_id>]

In the above command, the --show-deleted flag includes the deleted roles in the results.

Describe IAM Role

Run the following command to retrieve the metadata, including permissions, of a specified IAM role:

gcloud iam roles describe <role_id> [--organization=<organization>] [--project=<project_id>]

Get IAM Policies

Run the following commands to get the IAM policies:

gcloud organizations get-iam-policy <organization_id>

for an organization.

gcloud projects get-iam-policy <project_id>

for a project.

gcloud resource-manager folders get-iam-policy <folder_id>

for a folder.

Note: Although the above commands do not require full administrator privileges, they do require specific elevated permissions, typically granted to certain roles.

List Cloud Storage Buckets

Run the following command to list all cloud storage buckets within the default project:

gsutil ls

Attackers can find cloud storage buckets for a particular project by specifying project_id using the -p flag.

Retrieve Bucket Permissions

Run the following command to retrieve the permissions on a specific cloud storage bucket:

gsutil iam get gs://<bucket_name>

List Bucket Contents

Run the following command to find the bucket content, including the objects and names of the subdirectories it contains:

gsutil ls gs://<bucket_name>

List Cloud Storage Buckets

Run the following command to list all cloud storage buckets within the default project:

gsutil ls

Attackers can find cloud storage buckets for a particular project by specifying project_id using the -p flag.

Retrieve Bucket Permissions

Run the following command to retrieve the permissions on a specific cloud storage bucket:

gsutil iam get gs://<bucket_name>

List Bucket Contents

Run the following command to find the bucket content, including the objects and names of the subdirectories it contains:

gsutil ls gs://<bucket_name>

Attackers can use the -r option to recursively list the bucket contents.

Enumerating Google Cloud Services using gcp_service_enum

Source: https://github.com

gcp_service_enum is a Python script that allows attackers to discover various GCP services, including Compute Engine instances and Cloud Storage buckets. Attackers can use this tool to identify publicly accessible resources and misconfigurations within a targeted Google Cloud account by providing a service account key file.

Attackers can run the following command to enumerate services on a targeted GCP account using gcp_service_enum and save the results to a file:

gcp_enum_services.py -f <service account key file> --output-file <output file>

Enumerating GCP Resources using GCP Scanner

Source: https://github.com

Attackers use GCP Scanner to determine the level of access that certain credentials possess within GCP and evaluate the impact of compromised VMs, containers, GCP service accounts, or leaked OAuth2 token keys. It supports a wide range of GCP resources including GCE, GCS, GKE, App Engine, Cloud SQL, BigQuery, Spanner, Pub/Sub, Cloud Functions, BigTable, CloudStore, KMS, and Cloud Services.

GCP Scanner can extract and use credentials such as GCP VM instance metadata, user credentials from gcloud profiles, OAuth2 Refresh Tokens with cloud-platform scope, and GCP service account keys in JSON format. By leveraging these capabilities, attackers can gain insight into permissions and potential vulnerabilities, enabling more targeted and effective exploitation strategies within the Google Cloud environment.

Attackers can execute the following commands to scan and enumerate various resources and permissions within a target GCP environment:

python3 scanner.py -o <output file> -g <Gcloud profile path>

Here, -o: Specifies the output file where the results are saved. -g: Specifies the path to the gcloud profile containing the credentials to be used for scanning.

Figure 19.127: Screenshot of GCP Scanner

Enumerating Google Cloud Storage Buckets using cloud_enum

Source: https://github.com

The cloud_enum tool is a multi-cloud OSINT tool that enables attackers to enumerate public resources across AWS, Cloud/vendors/azure, and Google Cloud environments. Using this tool, attackers can retrieve information from open or publicly accessible GCP buckets, Firebase Realtime Databases, Google App Engine sites, cloud functions, and open Firebase applications, empowering them to assess potential targets.

Attackers can run the following command to enumerate Google Cloud Storage Buckets using the cloud_enum tool:

cloud_enum.py -k <keyword> --disable-aws --disable-azure

In the above command, the --disable-aws and --disable-azure flags skip Azure and Amazon checks to ensure faster Google Storage Buckets checks.

Figure 19.128: Screenshot of GCP bucket enumeration using cloud_enum

Alternatively, attackers can use the GrayhatWarfare tool to identify and access publicly accessible storage buckets on Google Cloud Platform.

Enumerating Privilege Escalation Vulnerabilities using GCP Privilege Escalation Scanner

Source: https://github.com

The GCP Privilege Escalation Scanner is a Python script that an attacker can use to identify potential privilege escalation vulnerabilities within GCP environments. This scanner evaluates IAM policies and permissions across GCP resources to detect misconfigurations and weaknesses that could allow an attacker to gain elevated privileges.

Given below are the steps an attacker initiates to enumerate privilege escalation vulnerabilities on a targeted GCP project using the GCP Privilege Escalation Scanner:

Step 1: List Member Permissions

Run the following command to list all permissions of each member within the targeted GCP project:

python3 enumerate_member_permissions.py --project-id test-<project ID>

Step 2: Scan for Privilege Escalation

Using the enumerated permissions, scan for potential privilege escalation vulnerabilities:

python3 check_for_privesc.py

Step 3: Review Results

Once the scan is completed, the attacker obtains the following files containing privilege escalation vulnerabilities for the GCP project:

• all_org_folder_proj_sa_permissions.json: This file contains a list of all the members and their associated permissions within a project.
• privesc_methods.txt: This file lists all the identified methods that can be used to escalate privileges within the GCP environment.
• setIamPolicy_methods.txt: This file details all the detected methods that involve setting IAM policies that can be exploited for privilege escalation.

Figure 19.129: Screenshot of GCP Privilege Escalation Scanner

Note: Reading and managing permissions specific to IAM resources are generally sufficient to perform this activity.