GitBook: [#3019] No subject

cloud-security/workspace-security.md

@@ -1,30 +1,23 @@
 # Workspace Security
 
-## Password Spraying
+## Workspace Phishing
 
-In order to test passwords with all the emails you found (or you have generated based in a email name pattern you might have discover) you can use a tool like [https://github.com/ustayready/CredKing](https://github.com/ustayready/CredKing) who will use AWS lambdas to change IP address.
+### Generic Phishing Methodology
 
-## Google Groups Abuse
+{% content-ref url="../phishing-methodology/" %}
+[phishing-methodology](../phishing-methodology/)
+{% endcontent-ref %}
 
-### Privesc
+### Google Groups Phishing
 
-By default in workspace a **group** can be **freely accessed** by any member of the organization.\
-Workspace also allow to **grant permission to groups** (even GCP permissions), so if groups can be joined and they have extra permissions, an attacker may **abuse that path to escalate privileges**.
+Apparently by default in workspace members [**can create groups**](https://groups.google.com/all-groups) **and invite people to them**. You can then modify the email that will be sent to the user **adding some links.** The **email will come from a google address**, so it will looks **legit** and people might click on the link.
 
-You potentially need access to the console to join groups that allow to be joined by anyone in the org. Check groups information in [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups).
-
-### Invite to groups
-
-Apparently by default you [**can create groups**](https://groups.google.com/all-groups) **and invite people to them**. You can then modify the email that will be sent to the user **adding some links** and the **email will come from google**, so it will looks **legit**.
-
-### Access Groups Mail info
-
-Again, from [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups) **** you can see the history of mails sent to the mail groups the user is member of, and you might find **credentials** or other **sensitive data**.
-
-## Hangout Phishing
+### Hangout Phishing
 
 You might be able either to directly talk with a person just having his email address or sending an invitation to talk. Either way, modify an email account maybe naming it "Google Security" and adding some Google logos, and the people will think they are talking to google: [https://www.youtube.com/watch?v=KTVHLolz6cE\&t=904s](https://www.youtube.com/watch?v=KTVHLolz6cE\&t=904s)
 
+Just the **same technique** can be used with **Google Chat**.
+
 ### Google Doc Phishing
 
 You can create an **apparently legitimate document** and the in a comment **mention some email (like +user@gmail.com)**. Google will **send an email to that email address** notifying that he was mentioned in the document. You can **put a link in that document** to try to make the persona access it.
@@ -38,6 +31,16 @@ To make it looks less suspicious:
 * Do **NOT send emails notifying about the event**. Then, the people will only see their warning about a meeting in 5mins and that they need to read that link.
 * Apparently using the API you can set to **True** that **people** has **accepted** the event and even create **comments on their behalf**.
 
+### OAuth Phishing
+
+Any of the previous techniques might be used to make the user access a **Google OAuth application** that will **request** the user some **access**. If the user **trust** the **source** he might **trust** the **application** (even if it's asking for high privileged permissions).
+
+Note that Google presents an ugly prompt asking warning that the application is untrusted in several cases and from Workspace admins can even prevent people to accept OAuth applications. More on this in the OAuth section.
+
+## Password Spraying
+
+In order to test passwords with all the emails you found (or you have generated based in a email name pattern you might have discover) you can use a tool like [**https://github.com/ustayready/CredKing**](https://github.com/ustayready/CredKing) who will use AWS lambdas to change IP address.
+
 ## Oauth Apps
 
 **Google** allows to create applications that can **interact on behalf users** with several **Google services**: Gmail, Drive, GCP...
@@ -106,37 +109,43 @@ This also means that if an **App Script already existed** and people has **grant
 
 ## Post-Exploitation
 
-### Privesc to GCP
+### Google Groups Privesc
+
+By default in workspace a **group** can be **freely accessed** by any member of the organization.\
+Workspace also allow to **grant permission to groups** (even GCP permissions), so if groups can be joined and they have extra permissions, an attacker may **abuse that path to escalate privileges**.
+
+You potentially need access to the console to join groups that allow to be joined by anyone in the org. Check groups information in [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups).
+
+### Privesc to GCP Summary
 
 * Abusing the **google groups privesc** you might be able to escalate to a group with some kind of privileged access to GCP
 * Abusing **OAuth applications** you might be able to impersonate users and access to GCP on their behalf
 
-### Maintaining Persistence inside a Google account
+### Access Groups Mail info
 
-If you managed to **compromise a google user session** and the user had **2FA**, you can **generate** an [**app password**](https://support.google.com/accounts/answer/185833?hl=en) and **regenerate the 2FA backup codes** to know that even if the user change the password you **will be able to access his account**. Another option **instead** of **regenerating** the codes is to **enrol your own authenticator** app in the 2FA.
+If you managed to **compromise a google user session**, from [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups) **** you can see the history of mails sent to the mail groups the user is member of, and you might find **credentials** or other **sensitive data**.
 
-### Maintaining Persistence via OAuth Apps
-
-If you have **compromised the account of a user,** you can just **accept** to grant all the possible permissions to an **OAuth App**. The only problem is that Workspace can configure to **disallow external and/or internal OAuth apps** without being reviewed.\
-It is pretty common to not trust by default external OAuth apps but trust internal ones, so if you have **enough permissions to generate a new OAuth application** inside the organization and external apps are disallowed, generate it and **use that new internal OAuth app to maintain persistence**.
-
-### Maintaining Persistence via delegation
-
-You can just delegate the account to a different account controlled by the attacker
-
-### Maintaining Persistence via Android App
-
-If you have a **session inside victims google account** you can browse to the **Play Store** and **install** a **malware** you have already uploaded it directly **in the phone** to maintain persistence and access the victims phone.
-
-### Download Everything Google Knows about and account
+### Takeout - Download Everything Google Knows about an account
 
 If you have a **session inside victims google account** you can download everything Google saves about that account from [**https://takeout.google.com**](https://takeout.google.com/u/1/?pageId=none)****
 
-### **Administrate Workspace**
+### Vault - Download all the Workspace data of users
 
-In [**https://admin.google.com**/](https://admin.google.com), if you have enough permissions you might be able to modify setting in the Workspace of the whole organization.
+If an organization has **Google Vault enabled**, you might be able to access [**https://vault.google.com**](https://vault.google.com/u/1/) **** and **download** all the **information**.
 
-### Google Drive
+### Contacts download
+
+From [**https://contacts.google.com**](https://contacts.google.com/u/1/?hl=es\&tab=mC) you can download all the **contacts** of the user.
+
+### Cloudsearch
+
+In [**https://cloudsearch.google.com/**](https://cloudsearch.google.com) you can just search **through all the Workspace content** (email, drive, sites...) a user has access to. Ideal to **find quickly sensitive information**.
+
+### Currents
+
+In [**https://currents.google.com/**](https://currents.google.com) you can access a Google **Chat**, so you might find sensitive information in there.
+
+### Google Drive Mining
 
 When **sharing** a document yo can **specify** the **people** that can access it one by one, **share** it with your **entire company** (**or** with some specific **groups**) by **generating a link**.
 
@@ -149,20 +158,47 @@ Some proposed ways to find all the documents:
 * Search in internal chat, forums...
 * **Spider** known **documents** searching for **references** to other documents. You can do this within an App Script with[ **PaperChaser**](https://github.com/mandatoryprogrammer/PaperChaser)****
 
-### **Gmail**
+### **Keep Notes**
+
+In [**https://keep.google.com/**](https://keep.google.com) you can access the notes of the user, **sensitive** **information** might be saved in here.
+
+### Persistence inside a Google account
+
+If you managed to **compromise a google user session** and the user had **2FA**, you can **generate** an [**app password**](https://support.google.com/accounts/answer/185833?hl=en) and **regenerate the 2FA backup codes** to know that even if the user change the password you **will be able to access his account**. Another option **instead** of **regenerating** the codes is to **enrol your own authenticator** app in the 2FA.
+
+### Persistence via OAuth Apps
+
+If you have **compromised the account of a user,** you can just **accept** to grant all the possible permissions to an **OAuth App**. The only problem is that Workspace can configure to **disallow external and/or internal OAuth apps** without being reviewed.\
+It is pretty common to not trust by default external OAuth apps but trust internal ones, so if you have **enough permissions to generate a new OAuth application** inside the organization and external apps are disallowed, generate it and **use that new internal OAuth app to maintain persistence**.
+
+### Persistence via delegation
+
+You can just **delegate the account** to a different account controlled by the attacker.
+
+### Persistence via Android App
+
+If you have a **session inside victims google account** you can browse to the **Play Store** and **install** a **malware** you have already uploaded it directly **in the phone** to maintain persistence and access the victims phone.
+
+### **Persistence via Gmail**
 
 * You can create **filters to hide** security notifications from Google
   * from: (no-reply@accounts.google.com) "Security Alert"
   * Hide password reset emails
-* Create **forwarding address to send sensitive information** (You need manual access)
+* Create **forwarding address to forward sensitive information** (or everything) - You need manual access.
   * Create a forwarding address to send emails that contains the word "password" for example
-* Add recovery email/phone under attackers control
-* Grab all the email addresses
+* Add **recovery email/phone under attackers control**
 
-### App Scripts
+### **Persistence via** App Scripts
 
-* Create **time-based triggers** to main **persistance**
-  * The docs mention that to use `ScriptApp.newTrigger("funcion")` you need the **scope** `script.scriptapp`, but **apparently thats not necessary** as long as you have declare some other scope..
+You can create **time-based triggers** in App Scripts, so if the App Script is accepted by the user, it will be **triggered** even **without the user accessing it**.
+
+The docs mention that to use `ScriptApp.newTrigger("funcion")` you need the **scope** `script.scriptapp`, but **apparently thats not necessary** as long as you have declare some other scope.
+
+### **Administrate Workspace**
+
+In [**https://admin.google.com**/](https://admin.google.com), if you have enough permissions you might be able to modify settings in the Workspace of the whole organization.
+
+You can also search emails through all the users invoices in [**https://admin.google.com/ac/emaillogsearch**](https://admin.google.com/ac/emaillogsearch)****
 
 ## Account Compromised Recovery
 
@@ -181,3 +217,4 @@ Some proposed ways to find all the documents:
 ## References
 
 * [https://www.youtube-nocookie.com/embed/6AsVUS79gLw](https://www.youtube-nocookie.com/embed/6AsVUS79gLw) - Matthew Bryant - Hacking G Suite: The Power of Dark Apps Script Magic
+* [https://www.youtube.com/watch?v=KTVHLolz6cE](https://www.youtube.com/watch?v=KTVHLolz6cE) - Mike Felch and Beau Bullock - OK Google, How do I Red Team GSuite?