Skip to content

Commit a5b2e16

Browse files
rileydakotarileydak-lrchristophetd
authored
New technique: GCP Credential Access via Secret Manager via AccessSecretVersion (#625)
* feat: add gcp secret manager credential access technique * fix: terraform fmt and cleanup * chore: code fixes and hygiene * chore: more code cleanup * Reflect new Go version requirements in the README * Add output to warm-up phase * Use _ as an unused parameter name * User errors.Is to compare error types * Remove unnecessary variable assignment * Enhance and autogenerate docs * staticcheck: Fix usage of deprecated GCP SDK types --------- Co-authored-by: Dakota Riley <[email protected]> Co-authored-by: Christophe Tafani-Dereeper <[email protected]>
1 parent 36eb8f1 commit a5b2e16

File tree

13 files changed

+400
-96
lines changed

13 files changed

+400
-96
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ See the documentation at **[stratus-red-team.cloud](https://stratus-red-team.clo
3333

3434
### Direct install
3535

36-
Requires Go 1.21+
36+
Requires Go 1.22+
3737

3838
```
3939
go install -v github.com/datadog/stratus-red-team/v2/cmd/stratus@latest

‎docs/attack-techniques/GCP/gcp.credential-access.secretmanager-retrieve-secrets.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
title: Retrieve a High Number of Secret Manager secrets
3+
---
4+
5+
# Retrieve a High Number of Secret Manager secrets
6+
7+
8+
<span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span>
9+
10+
Platform: GCP
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Credential Access
16+
17+
## Description
18+
19+
20+
Retrieves a high number of Secret Manager secrets in a short timeframe, through the AccessSecretVersion API.
21+
22+
<span style="font-variant: small-caps;">Warm-up</span>:
23+
24+
- Create multiple secrets in Secret Manager.
25+
26+
<span style="font-variant: small-caps;">Detonation</span>:
27+
28+
- Enumerate the secrets through the ListSecrets API
29+
- Retrieve each secret value, one by one through the AccessSecretVersion API
30+
31+
32+
## Instructions
33+
34+
```bash title="Detonate with Stratus Red Team"
35+
stratus detonate gcp.credential-access.secretmanager-retrieve-secrets
36+
```
37+
## Detection
38+
39+
Cloud Audit Logs event corresponding to accessing a secret's value is <code>AccessSecretVersion</code>.
40+
It is considered [data access event](https://cloud.google.com/secret-manager/docs/audit-logging), and needs to be explicitly enabled for the Secret Manager API.
41+
42+
Sample event:
43+
44+
```json hl_lines="18 20 25"
45+
{
46+
"protoPayload": {
47+
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
48+
"requestMetadata": {
49+
"callerIp": "7.7.7.7",
50+
"callerSuppliedUserAgent": "stratus-red-team_4fbc5d44-9c4f-469f-a15b-0c85e6ad3241 grpc-go/1.70.0,gzip(gfe)",
51+
"requestAttributes": {
52+
"time": "2025-02-02T22:56:34.343726445Z",
53+
"auth": {}
54+
},
55+
"destinationAttributes": {}
56+
},
57+
"serviceName": "secretmanager.googleapis.com",
58+
"methodName": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion",
59+
"authorizationInfo": [
60+
{
61+
"permission": "secretmanager.versions.access",
62+
"granted": true,
63+
"resourceAttributes": {
64+
"service": "secretmanager.googleapis.com",
65+
"name": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest",
66+
"type": "secretmanager.googleapis.com/SecretVersion"
67+
},
68+
"permissionType": "DATA_READ"
69+
}
70+
],
71+
"resourceName": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest",
72+
"request": {
73+
"name": "projects/victim-project/secrets/stratus-red-team-retrieve-secret-8/versions/latest",
74+
"@type": "type.googleapis.com/google.cloud.secretmanager.v1.AccessSecretVersionRequest"
75+
}
76+
},
77+
"resource": {
78+
"type": "audited_resource",
79+
"labels": {
80+
"method": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion",
81+
"project_id": "victim-project",
82+
"service": "secretmanager.googleapis.com"
83+
}
84+
}
85+
}
86+
```
87+
88+
References:
89+
90+
- https://cloud.hacktricks.wiki/en/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.html
91+
92+
93+

‎docs/attack-techniques/GCP/index.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ This page contains the Stratus attack techniques for GCP, grouped by MITRE ATT&C
44
Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.
55

66

7+
## Credential Access
8+
9+
- [Retrieve a High Number of Secret Manager secrets](./gcp.credential-access.secretmanager-retrieve-secrets.md)
10+
11+
712
## Exfiltration
813

914
- [Exfiltrate Compute Disk by sharing it](./gcp.exfiltration.share-compute-disk.md)

‎docs/attack-techniques/list.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ This page contains the list of all Stratus Attack Techniques.
6363
| [Create Hidden Scoped Role Assignment Through HiddenMembership AU](./entra-id/entra-id.persistence.hidden-au.md) | [Entra ID](./entra-id/index.md) | Persistence |
6464
| [Create Application](./entra-id/entra-id.persistence.new-application.md) | [Entra ID](./entra-id/index.md) | Persistence, Privilege Escalation |
6565
| [Create Sticky Backdoor User Through Restricted Management AU](./entra-id/entra-id.persistence.restricted-au.md) | [Entra ID](./entra-id/index.md) | Persistence |
66+
| [Retrieve a High Number of Secret Manager secrets](./GCP/gcp.credential-access.secretmanager-retrieve-secrets.md) | [GCP](./GCP/index.md) | Credential Access |
6667
| [Exfiltrate Compute Disk by sharing it](./GCP/gcp.exfiltration.share-compute-disk.md) | [GCP](./GCP/index.md) | Exfiltration |
6768
| [Exfiltrate Compute Image by sharing it](./GCP/gcp.exfiltration.share-compute-image.md) | [GCP](./GCP/index.md) | Exfiltration |
6869
| [Exfiltrate Compute Disk by sharing a snapshot](./GCP/gcp.exfiltration.share-compute-snapshot.md) | [GCP](./GCP/index.md) | Exfiltration |

‎docs/index.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,14 @@ EKS:
385385
platform: EKS
386386
isIdempotent: false
387387
GCP:
388+
Credential Access:
389+
- id: gcp.credential-access.secretmanager-retrieve-secrets
390+
name: Retrieve a High Number of Secret Manager secrets
391+
isSlow: false
392+
mitreAttackTactics:
393+
- Credential Access
394+
platform: GCP
395+
isIdempotent: true
388396
Exfiltration:
389397
- id: gcp.exfiltration.share-compute-disk
390398
name: Exfiltrate Compute Disk by sharing it

‎v2/go.mod‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
module github.com/datadog/stratus-red-team/v2
22

3-
go 1.21
3+
go 1.22.7
44

5-
toolchain go1.23.1
5+
toolchain go1.23.5
66

77
require (
8-
cloud.google.com/go/compute v1.10.0
8+
cloud.google.com/go/compute v1.31.1
9+
cloud.google.com/go/secretmanager v1.14.4
910
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
1011
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
1112
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0
@@ -41,15 +42,19 @@ require (
4142
github.com/microsoftgraph/msgraph-beta-sdk-go v0.108.0
4243
github.com/microsoftgraph/msgraph-sdk-go-core v1.2.1
4344
github.com/spf13/cobra v1.6.0
44-
github.com/stretchr/testify v1.9.0
45-
google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e
45+
github.com/stretchr/testify v1.10.0
46+
google.golang.org/genproto v0.0.0-20250122153221-138b5a5a4fd4
4647
gopkg.in/yaml.v3 v3.0.1
4748
k8s.io/api v0.25.3
4849
k8s.io/apimachinery v0.25.3
4950
k8s.io/client-go v0.25.3
5051
)
5152

5253
require (
54+
cloud.google.com/go/auth v0.14.0 // indirect
55+
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
56+
cloud.google.com/go/compute/metadata v0.6.0 // indirect
57+
cloud.google.com/go/iam v1.3.1 // indirect
5358
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
5459
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
5560
github.com/ProtonMail/go-crypto v1.1.0-alpha.2 // indirect
@@ -72,19 +77,20 @@ require (
7277
github.com/cloudflare/circl v1.3.7 // indirect
7378
github.com/davecgh/go-spew v1.1.1 // indirect
7479
github.com/emicklei/go-restful/v3 v3.8.0 // indirect
75-
github.com/go-logr/logr v1.4.1 // indirect
80+
github.com/felixge/httpsnoop v1.0.4 // indirect
81+
github.com/go-logr/logr v1.4.2 // indirect
7682
github.com/go-logr/stdr v1.2.2 // indirect
7783
github.com/go-openapi/jsonpointer v0.19.5 // indirect
7884
github.com/go-openapi/jsonreference v0.19.5 // indirect
7985
github.com/go-openapi/swag v0.19.14 // indirect
8086
github.com/gogo/protobuf v1.3.2 // indirect
8187
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
82-
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
83-
github.com/golang/protobuf v1.5.2 // indirect
88+
github.com/golang/protobuf v1.5.4 // indirect
8489
github.com/google/gnostic v0.5.7-v3refs // indirect
8590
github.com/google/gofuzz v1.1.0 // indirect
86-
github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
87-
github.com/googleapis/gax-go/v2 v2.5.1 // indirect
91+
github.com/google/s2a-go v0.1.9 // indirect
92+
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
93+
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
8894
github.com/imdario/mergo v0.3.15 // indirect
8995
github.com/inconshreveable/mousetrap v1.0.1 // indirect
9096
github.com/josharian/intern v1.0.0 // indirect
@@ -111,17 +117,21 @@ require (
111117
github.com/spf13/pflag v1.0.5 // indirect
112118
github.com/std-uritemplate/std-uritemplate/go v0.0.57 // indirect
113119
github.com/stretchr/objx v0.5.2 // indirect
114-
go.opencensus.io v0.23.0 // indirect
115-
go.opentelemetry.io/otel v1.24.0 // indirect
116-
go.opentelemetry.io/otel/metric v1.24.0 // indirect
117-
go.opentelemetry.io/otel/trace v1.24.0 // indirect
120+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
121+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 // indirect
122+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
123+
go.opentelemetry.io/otel v1.34.0 // indirect
124+
go.opentelemetry.io/otel/metric v1.34.0 // indirect
125+
go.opentelemetry.io/otel/trace v1.34.0 // indirect
118126
golang.org/x/mod v0.17.0 // indirect
119-
golang.org/x/net v0.27.0 // indirect
120-
golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
121-
golang.org/x/term v0.22.0 // indirect
122-
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
123-
google.golang.org/appengine v1.6.7 // indirect
124-
google.golang.org/protobuf v1.33.0 // indirect
127+
golang.org/x/net v0.34.0 // indirect
128+
golang.org/x/oauth2 v0.25.0 // indirect
129+
golang.org/x/sync v0.10.0 // indirect
130+
golang.org/x/term v0.28.0 // indirect
131+
golang.org/x/time v0.9.0 // indirect
132+
google.golang.org/genproto/googleapis/api v0.0.0-20250124145028-65684f501c47 // indirect
133+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
134+
google.golang.org/protobuf v1.36.4 // indirect
125135
gopkg.in/inf.v0 v0.9.1 // indirect
126136
gopkg.in/yaml.v2 v2.4.0 // indirect
127137
k8s.io/klog/v2 v2.70.1 // indirect
@@ -139,9 +149,9 @@ require (
139149
github.com/hashicorp/terraform-json v0.22.1 // indirect
140150
github.com/microsoftgraph/msgraph-sdk-go v1.47.0
141151
github.com/zclconf/go-cty v1.14.4 // indirect
142-
golang.org/x/crypto v0.25.0 // indirect
143-
golang.org/x/sys v0.22.0 // indirect
144-
golang.org/x/text v0.16.0 // indirect
145-
google.golang.org/api v0.99.0
146-
google.golang.org/grpc v1.50.0 // indirect
152+
golang.org/x/crypto v0.32.0 // indirect
153+
golang.org/x/sys v0.29.0 // indirect
154+
golang.org/x/text v0.21.0 // indirect
155+
google.golang.org/api v0.218.0
156+
google.golang.org/grpc v1.70.0 // indirect
147157
)

0 commit comments

Comments
 (0)