Impersonate GCP Service Account for Privileged Access

This beginner-friendly lab walks through discovering a GCP service account key in an exposed .git directory and using it to break into a Google Cloud project. You then escalate through service account impersonation, read a Cloud Source repository, and reach a Cloud SQL database holding sensitive data.

During an external engagement for Gigantic Retail, your team finds a subdomain hosting a web server. Your task is to explore it and find a path into their GCP cloud environment.

• Proficiency in basic Linux command line operations
• Familiarity with fundamental GCP IAM concepts
• gcloud CLI installed and configured

• Discover an exposed .git directory with Nmap and dump it with wget or git-dumper
• Use git log, branches, and git show to recover a deleted service account key (token.json)
• Authenticate to GCP with gcloud auth activate-service-account
• Enumerate project IAM policy, custom roles, and permissions, visualizing bindings with graphviz
• Escalate privileges via serviceAccountTokenCreator to impersonate a service account
• Enumerate and clone a Google Cloud Source repository to find database credentials
• List Cloud SQL instances and exfiltrate customer PII from a PostgreSQL database

Sensitive credentials are frequently discovered by enumerating exposed web servers, and initializing a git repository in the web root can leak an entire codebase including service account keys. Scans of millions of domains have repeatedly found exposed .git directories, making this a realistic and impactful initial access vector.