-
Notifications
You must be signed in to change notification settings - Fork 226
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
New technique: GCP Credential Access via Secret Manager via AccessSec…
…retVersion (#625) * feat: add gcp secret manager credential access technique * fix: terraform fmt and cleanup * chore: code fixes and hygiene * chore: more code cleanup * Reflect new Go version requirements in the README * Add output to warm-up phase * Use _ as an unused parameter name * User errors.Is to compare error types * Remove unnecessary variable assignment * Enhance and autogenerate docs * staticcheck: Fix usage of deprecated GCP SDK types --------- Co-authored-by: Dakota Riley <[email protected]> Co-authored-by: Christophe Tafani-Dereeper <[email protected]>
- Loading branch information
3 people
authored
Feb 14, 2025
1 parent
36eb8f1
commit a5b2e16
Showing
13 changed files
with
400 additions
and
96 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
93 changes: 93 additions & 0 deletions
93
docs/attack-techniques/GCP/gcp.credential-access.secretmanager-retrieve-secrets.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| --- | ||
| title: Retrieve a High Number of Secret Manager secrets | ||
| --- | ||
|
|
||
| # Retrieve a High Number of Secret Manager secrets | ||
|
|
||
|
|
||
| <span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span> | ||
|
|
||
| Platform: GCP | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Credential Access | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Retrieves a high number of Secret Manager secrets in a short timeframe, through the AccessSecretVersion API. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: | ||
|
|
||
| - Create multiple secrets in Secret Manager. | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Enumerate the secrets through the ListSecrets API | ||
| - Retrieve each secret value, one by one through the AccessSecretVersion API | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate gcp.credential-access.secretmanager-retrieve-secrets | ||
| ``` | ||
| ## Detection | ||
|
|
||
| Cloud Audit Logs event corresponding to accessing a secret's value is <code>AccessSecretVersion</code>. | ||
| It is considered [data access event](https://cloud.google.com/secret-manager/docs/audit-logging), and needs to be explicitly enabled for the Secret Manager API. | ||
|
|
||
| Sample event: | ||
|
|
||
| ```json hl_lines="18 20 25" | ||
| { | ||
| "protoPayload": { | ||
| "@type": "type.googleapis.com/google.cloud.audit.AuditLog", | ||
| "requestMetadata": { | ||
| "callerIp": "7.7.7.7", | ||
| "callerSuppliedUserAgent": "stratus-red-team_4fbc5d44-9c4f-469f-a15b-0c85e6ad3241 grpc-go/1.70.0,gzip(gfe)", | ||
| "requestAttributes": { | ||
| "time": "2025-02-02T22:56:34.343726445Z", | ||
| "auth": {} | ||
| }, | ||
| "destinationAttributes": {} | ||
| }, | ||
| "serviceName": "secretmanager.googleapis.com", | ||
| "methodName": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion", | ||
| "authorizationInfo": [ | ||
| { | ||
| "permission": "secretmanager.versions.access", | ||
| "granted": true, | ||
| "resourceAttributes": { | ||
| "service": "secretmanager.googleapis.com", | ||
| "name": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest", | ||
| "type": "secretmanager.googleapis.com/SecretVersion" | ||
| }, | ||
| "permissionType": "DATA_READ" | ||
| } | ||
| ], | ||
| "resourceName": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest", | ||
| "request": { | ||
| "name": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest", | ||
| "@type": "type.googleapis.com/google.cloud.secretmanager.v1.AccessSecretVersionRequest" | ||
| } | ||
| }, | ||
| "resource": { | ||
| "type": "audited_resource", | ||
| "labels": { | ||
| "method": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion", | ||
| "project_id": "victim-project", | ||
| "service": "secretmanager.googleapis.com" | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| References: | ||
|
|
||
| - https://cloud.hacktricks.wiki/en/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.html | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.