Skip to content

v0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 21:25
v0.8.0
9cbb41d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Major release: a new text-based OpenGraph attack-path analyzer (process_og_attack_paths), a large wave of service-account impersonation exploits, broader enumeration, and Google Workspace support.

🔎 OpenGraph attack paths

  • New process_og_attack_paths — PMapper-style text pathfinding over exported OpenGraph JSON (for when BloodHound is unavailable or the graph is too big).
    • Selectors --to-role / --to-sa / --to-kind / --to-node / --to-any; scope filtering --at-scope (id or number) + --exact-scope; --from, --exclude-node, --exclude-service-agents, --no-direct; collapsed/--expanded views, --all-paths, --summary, --json.
    • Basic-role queries also surface principals who can grant themselves the role via setIamPolicy.
  • Edge-correctness fixes, false-path removal, WIF federation edges, IAM Deny Policy modeling, cross-project SA toggle.
  • Large-graph memory/perf: --low-memory combo streaming + split-JSON output.

💥 Exploit modules (run a resource as a target SA)

  • 38 new *_as_sa token-exfil modules across Compute, Cloud Run, Cloud Functions, Cloud Build, Cloud Deploy, GKE, Dataflow, Dataproc, Dataplex, Batch, Composer, DataFusion, Deployment/Infra Manager, Cloud Workflows, Cloud Tasks, App Engine, Vertex AI, Notebooks, TPU, BigQuery, IAM, and more.

📋 Enumeration & services

  • Coverage expanded to 60+ GCP services (GAPIC-based).
  • enum_all: --dont-modules, service multithreading / --parallel-services, permission short-circuiting, resume tokens, cooperative Ctrl+C.

🧑‍💼 Google Workspace

  • Drive enum/exploit and domain-wide delegation (incl. implicit SA delegation chains); Directory, Groups, Cloud Identity modules.

⚙️ Framework & deps

  • Unified SQLite datastore; creds subcommand renames (set→update, update→replace); cross-platform executables (Linux/macOS/Windows); updated google-cloud/boto3 deps.

🧪 Example workflow

# 1. Enumerate resources + IAM bindings
modules run enum_gcp
modules run enum_gcp_policy_bindings

# 2. Build the OpenGraph JSON
modules run process_og_gcpwn_data --expand-inherited --reset --out output.json

# 3. Find every principal that can reach owner on the org (text-based, no BloodHound needed)
modules run process_og_attack_paths --graph-json output.json --to-role roles/owner --at-scope organizations/<ORG_ID>

Install: pip install gcpwn (extras: gcpwn[table,excel]) · Docs

Assets 14
Loading