Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

IAM Privilege Escalation in GCP

Table of Contents

  • The PrivEscScanner Folder
    • Contains a permissions enumerator for all members in a GCP account and an associated privilege escalation scanner that reviews the permissions in search of privilege escalation vulnerabilities.
    • First run to enumerate all members and permissions and then run to check for privilege escalation in the environment.
  • The ExploitScripts Folder
    • Contains exploit scripts for each of the privilege escalation methods outlined in the blog post, as well as a Cloud Function and Docker image for some of the methods that require them.

For more information on these privilege escalation methods, how to exploit them, the permissions they require, and more, see the blog posts on our website: Part 1 and Part 2

Current List of GCP IAM Privilege Escalation Methods

  1. cloudbuilds.builds.create: Script / Blog Post
  2. deploymentmanager.deployments.create: Script / Blog Post
  3. iam.roles.update: Script / Blog Post
  4. iam.serviceAccounts.getAccessToken: Script / Blog Post
  5. iam.serviceAccountKeys.create: Script / Blog Post
  6. iam.serviceAccounts.implicitDelegation: Script / Blog Post
  7. iam.serviceAccounts.signBlob: Script / Blog Post
  8. iam.serviceAccounts.signJwt: Script / Blog Post
  9. cloudfunctions.functions.create: Script / Blog Post
  10. cloudfunctions.functions.update: Script / Blog Post
  11. compute.instances.create: Script / Blog Post
  12. Script / Blog Post
  13. Blog Post
  14. orgpolicy.policy.set: Script / Blog Post
  15. storage.hmacKeys.create: Script / Blog Post
  16. serviceusage.apiKeys.create: Script / Blog Post
  17. serviceusage.apiKeys.list: Script / Blog Post


A collection of GCP IAM privilege escalation methods documented by the Rhino Security Labs team.







No releases published


No packages published