GITBOOK-544: change request with no subject merged in GitBook

HackTricks-wiki · Jan 24, 2024 · 4c6b672 · 4c6b672
1 parent 2dd2431
commit 4c6b672
Show file tree

Hide file tree

Showing 4 changed files with 126 additions and 0 deletions.
diff --git a/.gitbook/assets/image (141).png b/.gitbook/assets/image (141).png
diff --git a/SUMMARY.md b/SUMMARY.md
@@ -162,6 +162,7 @@
     * [GCP - Cloud Run Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md)
     * [GCP - Cloud SQL Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md)
     * [GCP - Compute Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md)
+    * [GCP - IAM, Principals & Org Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md)
     * [GCP - Source Repositories Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md)
     * [GCP - Storage Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md)
       * [GCP - Public Buckets Privilege Escalation](pentesting-cloud/gcp-security/gcp-unaunthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md)

diff --git a/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md b/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md
@@ -190,6 +190,12 @@ In the following page you can check how to **abuse IAM permissions to escalate p
 [gcp-iam-privesc.md](../gcp-privilege-escalation/gcp-iam-privesc.md)
 {% endcontent-ref %}
 
+### Unauthenticated Enum <a href="#service-account-impersonation" id="service-account-impersonation"></a>
+
+{% content-ref url="../gcp-unaunthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md" %}
+[gcp-iam-principals-and-org-unauthenticated-enum.md](../gcp-unaunthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md)
+{% endcontent-ref %}
+
 ### Post Exploitation <a href="#service-account-impersonation" id="service-account-impersonation"></a>
 
 {% content-ref url="../gcp-post-exploitation/gcp-iam-post-exploitation.md" %}

diff --git a/...nthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md b/...nthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md
@@ -0,0 +1,119 @@
+# GCP - IAM, Principals & Org Unauthenticated Enum
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)
+*
+*
+* &#x20;github repos.
+
+</details>
+
+## Iam & GCP Principals&#x20;
+
+For more information check:
+
+{% content-ref url="../gcp-services/gcp-iam-and-org-policies-enum.md" %}
+[gcp-iam-and-org-policies-enum.md](../gcp-services/gcp-iam-and-org-policies-enum.md)
+{% endcontent-ref %}
+
+### Is domain used in Workspace?
+
+1. **Check DNS records**
+
+If it has a **`google-site-verification`** record it's probable that it's (or it was) using Workspace:
+
+```
+dig txt hacktricks.xyz
+
+[...]
+hacktricks.xyz.		3600	IN	TXT	"google-site-verification=2mWyPXMPXEEy6QqWbCfWkxFTcQhyYdwHrOxee1Yeo-0"
+hacktricks.xyz.		3600	IN	TXT	"google-site-verification=C19PtLcZ1EGyzUYYJTX1Tp6bOGessxzN9gqE-SVKhRA"
+hacktricks.xyz.		300	IN	TXT	"v=spf1 include:usb._netblocks.mimecast.com include:_spf.google.com include:_spf.psm.knowbe4.com include:_spf.salesforce.com include:spf.mandrillapp.com ~all"
+```
+
+If something like **`include:_spf.google.com`** also appears it confirms it (note that if it doesn't appear it doesn't denies it as a domain can be in Workspace without using gmail as mail provider).
+
+2. **Try to setup a Workspace with that domain**
+
+Another option is to try to setup a Workspace using the domain, if it **complains that the domain is already used** (like in the image), you know it's already used!
+
+To try to setup a Workspace domain follow: [https://workspace.google.com/business/signup/welcome](https://workspace.google.com/business/signup/welcome)
+
+<figure><img src="../../../.gitbook/assets/image (141).png" alt=""><figcaption></figcaption></figure>
+
+3. **Try to recover the password of an email using that domain**
+
+If you know any valid email address being use din that domain (like: admin@email.com or info@email.com) you can try to **recover the account** in [https://accounts.google.com/signin/v2/recoveryidentifier](https://accounts.google.com/signin/v2/recoveryidentifier),  and if try doesn't shows an error indicating that Google has no idea about that account, then it's using Workspace.
+
+### Enumerate emails and service accounts
+
+It's possible to **enumerate valid emails of a Workspace domain and SA emails** by trying to assign them permissions and checking the error messages. For this you just need to have permissions to assign permission to a project (which can be just owned by you).
+
+Note that to check them but even if they exist not grant them a permission you can use the type **`serviceAccount`** when it's an **`user`** and **`user`** when it's a **`SA`**:
+
+{% code overflow="wrap" %}
+```bash
+# Try to assign permissions to user 'unvalid-email-34r434f@hacktricks.xyz'
+# but indicating it's a service account
+gcloud projects add-iam-policy-binding <project-controlled-by-you> \
+  --member='serviceAccount:unvalid-email-34r434f@hacktricks.xyz' \
+  --role='roles/viewer'
+## Response:
+ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User unvalid-email-34r434f@hacktricks.xyz does not exist.
+
+# Now try with a valid email
+gcloud projects add-iam-policy-binding <project-controlled-by-you> \
+  --member='serviceAccount:support@hacktricks.xyz' \
+  --role='roles/viewer'
+# Response:
+ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal support@hacktricks.xyz is of type "user". The principal should appear as "user:support@hacktricks.xyz". See https://cloud.google.com/iam/help/members/types for additional documentation.
+```
+{% endcode %}
+
+Note how when the user email was valid the error message indicated that they type isn't, so we managed to discover that the email support@hacktricks.xyz exists without granting it any privileges.
+
+You can so the **same with Service Accounts** using the type **`user:`** instead of **`serviceAccount:`**:
+
+{% code overflow="wrap" %}
+```bash
+# Non existent
+gcloud projects add-iam-policy-binding <project-controlled-by-you> \
+  --member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
+  --role='roles/viewer'
+# Response
+ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User <invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com does not exist.
+
+# Existent
+gcloud projects add-iam-policy-binding <project-controlled-by-you> \
+  --member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
+  --role='roles/viewer'
+# Response
+ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal testing@digital-bonfire-410512.iam.gserviceaccount.com is of type "serviceAccount". The principal should appear as "serviceAccount:testing@digital-bonfire-410512.iam.gserviceaccount.com". See https://cloud.google.com/iam/help/members/types for additional documentation.
+```
+{% endcode %}
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)
+*
+*
+* &#x20;github repos.
+
+</details>