Leverage Google Workspace for GCP Resource Access
Pivot from a Windows jumpbox through Google Workspace into GCP resources
Overview
In this red team lab, you’ll pivot from a compromised Windows jumpbox into Google Workspace and GCP. Using browser-stored credentials, you’ll enumerate services like Drive, Keep, and Gmail, uncover a service account key, and exploit misconfigured Pub/Sub and Cloud Storage to access a web application running on Cloud Run.
Objectives
During a red team engagement against shopgigantic.com, your colleague successfully phished an employee and gained credentials to access their Windows jumpbox and also their maildrop.cc account. From this initial foothold, your objective is to pivot further into the organization's infrastructure and demonstrate impact by gaining access to sensitive resources.
Prerequisites
- Basic understanding of Windows post-exploitation techniques
- Familiarity with Google Workspace (GWS) environment and apps (GDocs, GKeep, Gmail)
- Working knowledge of Google Cloud Platform (GCP)
Learning outcomes
- Understand how to pivot from a compromised endpoint to cloud infrastructure
- Practice GWS enumeration for sensitive data (Google Docs, Keep, Gmail)
- Learn to identify and exploit misconfigured or overly permissive GCP services
- Explore how insecure Firebase configurations can lead to backend bypasses
Real-world context
This scenario mirrors a realistic red team engagement where initial access to a compromised Windows workstation is used as a pivot point to infiltrate the organization's cloud infrastructure. By extracting browser-stored credentials, the attacker gains access to Google Workspace services like Drive, Gmail, and Keep, uncovering sensitive files and service account keys. With these credentials, they enumerate the cloud environment, identify misconfigured GCP services, and exploit a Pub/Sub mechanism to trigger backend actions illustrating how a local compromise can escalate into full cloud access through poor credential hygiene and weak access controls.