TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

Google Cloud Security Research and Tooling

1 post · Feb 2020

What this trail covers

This post details the Red Team's research into Google Cloud Platform (GCP) security, focusing on post-exploitation tactics for attackers who have gained an initial foothold on a Linux VM. It covers reconnaissance, privilege escalation, lateral movement, and data exfiltration within GCP environments. The post also introduces several open-source tools developed by the team to aid in this research and defense: gcp_firewall_enum, gcp_enum, and gcp_misc. The research aims to inform defenders about potential attacker methodologies and vulnerabilities in GCP configurations.

All GitLab trails
  1. Google Cloud privilege escalation & post-exploitation tacticsThis post introduces a deep dive into manual post-exploitation tactics and techniques for Google Cloud Platform (GCP), specifically focusing on compromising a single Linux-based virtual machine within Compute Engine. It details how an attacker can escalate local privileges to root, compromise other systems within the same GCP Project, break out into other projects, and potentially access G Suite. The post explains key GCP security concepts relevant to this scenario, including the resource hierarchy (Organization, Folders, Projects, Resources), service accounts (default and custom), access scopes, and IAM roles (primitive, predefined, and custom). It also introduces three new open-source tools: gcp_firewall_enum for targeted port scans, gcp_enum for consolidated enumeration commands, and gcp_misc for various attack techniques against GCP environments. An appendix on leveraging SSRF is also included.