Google Cloud provides secure and customizable compute service that lets you create and run virtual machines on Google’s infrastructure. Google cloud VMs provide scale-out workloads for best price-performance as compared to general-purpose VMs, useful for most demanding applications and workloads
What we are going to cover?
We will setup a target VM instance that will host a vulnerable application and exploit the app to gain access to service account credentials.
Steps to setup lab
Note: Setting up VMs in Google cloud will incur cost, however this is covered under the free credits that you have when you signed up to Google Cloud.
An image has been pre-created for the purpose of this lab. This image needs to be imported to your account and a vm instance needs to be created from it.
Before beginning, verify that you are using the correct account and project via gcloud cli
Verify account - gcloud auth list
Verify project - gcloud config get project
Please let the trainer know, or run the gcloud config commands to set these values correctly before proceeding.
1. Copying the VM Image to your account
Run the following command in a student machine terminal to import the image to your account
Run the following commands in a student machine terminal to create a VM from the image that was just copied
Note down the external IP printed on screen.
Updating the policy for lab exercises
3. Restricted access to Attacker Machine
Remember, this is a deliberately vulnerable app and should not be run on production or facing the Internet. The vulnerability in here does not require any authentication or complex payloads to be exploited.
Run the following command to open port 80 on the Google Cloud Network firewall to allow traffic from the Attacker Machine in AWS
Navigate to the external IP address via Firefox using an SSH tunnel to the attacker machine.
4. Creating Storage Objects to test exfiltration
We need to set up some storage buckets to test token validity and demonstrate exfiltration. Usually this would already be present on target accounts. Run the following commands to setup some storage objects in the target gcloud account. Run the commands one after the other.