takester/GCP-IAM-Privilege-Escalation

A collection of GCP IAM privilege escalation methods documented by the Rhino Security Labs team.

IAM Privilege Escalation in GCP

Table of Contents

• The PrivEscScanner Folder
  • Contains a permissions enumerator for all members in a GCP account and an associated privilege escalation scanner that reviews the permissions in search of privilege escalation vulnerabilities.
  • First run enumerate_member_permissions.py to enumerate all members and permissions and then run check_for_privesc.py to check for privilege escalation in the environment.
• The ExploitScripts Folder
  • Contains exploit scripts for each of the privilege escalation methods outlined in the blog post, as well as a Cloud Function and Docker image for some of the methods that require them.

For more information on these privilege escalation methods, how to exploit them, the permissions they require, and more, see the blog posts on our website: Part 1 and Part 2

Current List of GCP IAM Privilege Escalation Methods

1. cloudbuilds.builds.create: Script / Blog Post
2. deploymentmanager.deployments.create: Script / Blog Post
3. iam.roles.update: Script / Blog Post
4. iam.serviceAccounts.getAccessToken: Script / Blog Post
5. iam.serviceAccountKeys.create: Script / Blog Post
6. iam.serviceAccounts.implicitDelegation: Script / Blog Post
7. iam.serviceAccounts.signBlob: Script / Blog Post
8. iam.serviceAccounts.signJwt: Script / Blog Post
9. cloudfunctions.functions.create: Script / Blog Post
10. cloudfunctions.functions.update: Script / Blog Post
11. compute.instances.create: Script / Blog Post
12. run.services.create: Script / Blog Post
13. cloudscheduler.jobs.create: Blog Post
14. orgpolicy.policy.set: Script / Blog Post
15. storage.hmacKeys.create: Script / Blog Post
16. serviceusage.apiKeys.create: Script / Blog Post
17. serviceusage.apiKeys.list: Script / Blog Post