GCP: Privilege Escalation in GCP Service Account-based

[0xCardinal]

This needs to be broken in multiple parts -

• Privilege Escalation using Service Accounts
• Privilege Escalation using Compute Engine
• Privilege Escalation using APIKeys
• and there are many more ways to perform privilege escalation.

How many should we include in the 1st release of the list?

Reference

• https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/
• https://gcpgoat.joshuajebaraj.com/privilege-escalation.html
• https://cloud.hacktricks.xyz/pentesting-cloud/gcp-pentesting/gcp-privilege-escalation

[0xCardinal]

Privilege Escalation using Compute Engine - Covered.

[0xCardinal]

Privilege Escalation using Service Accounts - Anjali