GCP-IAM-Privilege-Escalation

GCP IAM privilege escalation methods and helpers.

IAM Privilege Escalation in GCP

Table of Contents

  • The PrivEscScanner Folder
    • Contains a permissions enumerator for all members in a GCP account and an associated privilege escalation scanner that reviews the permissions in search of privilege escalation vulnerabilities.
    • First run enumerate_member_permissions.py to enumerate all members and permissions and then run check_for_privesc.py to check for privilege escalation in the environment.
  • The ExploitScripts Folder
    • Contains exploit scripts for each of the privilege escalation methods outlined in the blog post, as well as a Cloud Function and Docker image for some of the methods that require them.

For more information on these privilege escalation methods, how to exploit them, the permissions they require, and more, see the blog posts on our website: Part 1 and Part 2

Current List of GCP IAM Privilege Escalation Methods

  1. cloudbuilds.builds.create: Script / Blog Post
  2. deploymentmanager.deployments.create: Script / Blog Post
  3. iam.roles.update: Script / Blog Post
  4. iam.serviceAccounts.getAccessToken: Script / Blog Post
  5. iam.serviceAccountKeys.create: Script / Blog Post
  6. iam.serviceAccounts.implicitDelegation: Script / Blog Post
  7. iam.serviceAccounts.signBlob: Script / Blog Post
  8. iam.serviceAccounts.signJwt: Script / Blog Post
  9. cloudfunctions.functions.create: Script / Blog Post
  10. cloudfunctions.functions.update: Script / Blog Post
  11. compute.instances.create: Script / Blog Post
  12. run.services.create: Script / Blog Post
  13. cloudscheduler.jobs.create: Blog Post
  14. orgpolicy.policy.set: Script / Blog Post
  15. storage.hmacKeys.create: Script / Blog Post
  16. serviceusage.apiKeys.create: Script / Blog Post
  17. serviceusage.apiKeys.list: Script / Blog Post