cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/gcp/pubsub_exploit.py

@@ -0,0 +1,85 @@
+"""GCP Pub/Sub message injection and subscription analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.pubsub_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute pubsub_exploit module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCP Pub/Sub message injection and subscription analysis")
+    print(f"[*] Provider: {provider} | Service: PublisherClient")
+    print(f"[*] Target: topics, subscriptions")
+
+    results: dict[str, Any] = {
+        "module": "pubsub_exploit",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.pubsub".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_pubsub_exploit", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating topics, subscriptions...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "publicly accessible topics",
+        }
+        print(f"[+] Analysis complete — key finding indicator: publicly accessible topics")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_pubsub_exploit", results)
+        return 1
+
+    _save(args, "gcp_pubsub_exploit", results)
+    return 0

cloudxpl/modules/gcp/sa_impersonate.py

@@ -0,0 +1,85 @@
+"""GCP service account impersonation chain analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.sa_impersonate.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute sa_impersonate module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCP service account impersonation chain analysis")
+    print(f"[*] Provider: {provider} | Service: IAM API")
+    print(f"[*] Target: SA impersonation permissions")
+
+    results: dict[str, Any] = {
+        "module": "sa_impersonate",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.iam".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_sa_impersonate", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating SA impersonation permissions...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "impersonation chains",
+        }
+        print(f"[+] Analysis complete — key finding indicator: impersonation chains")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_sa_impersonate", results)
+        return 1
+
+    _save(args, "gcp_sa_impersonate", results)
+    return 0

cloudxpl/modules/gcp/sa_key_theft.py

@@ -0,0 +1,85 @@
+"""GCP service account key extraction and analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.sa_key_theft.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute sa_key_theft module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCP service account key extraction and analysis")
+    print(f"[*] Provider: {provider} | Service: IAM API")
+    print(f"[*] Target: SA keys, key metadata")
+
+    results: dict[str, Any] = {
+        "module": "sa_key_theft",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.iam".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_sa_key_theft", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating SA keys, key metadata...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "long-lived SA keys",
+        }
+        print(f"[+] Analysis complete — key finding indicator: long-lived SA keys")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_sa_key_theft", results)
+        return 1
+
+    _save(args, "gcp_sa_key_theft", results)
+    return 0

cloudxpl/modules/gcp/secretmanager_exploit.py

@@ -0,0 +1,85 @@
+"""GCP Secret Manager enumeration and extraction."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.secretmanager_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute secretmanager_exploit module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCP Secret Manager enumeration and extraction")
+    print(f"[*] Provider: {provider} | Service: SecretManagerServiceClient")
+    print(f"[*] Target: secrets, versions")
+
+    results: dict[str, Any] = {
+        "module": "secretmanager_exploit",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.secretmanager".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_secretmanager_exploit", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating secrets, versions...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "accessible secret versions",
+        }
+        print(f"[+] Analysis complete — key finding indicator: accessible secret versions")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_secretmanager_exploit", results)
+        return 1
+
+    _save(args, "gcp_secretmanager_exploit", results)
+    return 0

cloudxpl/modules/gcp/service_account_enum.py

@@ -0,0 +1,107 @@
+"""GCP Service Account enumeration — list SAs, keys, permissions."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+import requests
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.service_account_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["gcp_api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1087.004"],
+}
+
+IAM_API = "https://iam.googleapis.com/v1"
+
+
+def _get_token() -> str | None:
+    try:
+        from google.auth.transport.requests import Request
+        from google.auth import default
+        creds, _ = default()
+        creds.refresh(Request())
+        return creds.token
+    except Exception:
+        return None
+
+
+def run(args: Any) -> int:
+    project = args.project_id
+    print(f"[*] GCP Service Account Enumeration (project: {project})")
+
+    token = _get_token()
+    if not token:
+        print("[!] Could not obtain GCP credentials", file=sys.stderr)
+        return 1
+
+    headers = {"Authorization": f"Bearer {token}"}
+
+    try:
+        resp = requests.get(
+            f"{IAM_API}/projects/{project}/serviceAccounts",
+            headers=headers,
+            timeout=15,
+        )
+        resp.raise_for_status()
+        accounts = resp.json().get("accounts", [])
+    except Exception as exc:
+        print(f"[-] list service accounts failed: {exc}", file=sys.stderr)
+        return 1
+
+    print(f"[+] {len(accounts)} service accounts")
+    results = []
+
+    for sa in accounts:
+        entry = {
+            "email": sa.get("email"),
+            "name": sa.get("displayName"),
+            "unique_id": sa.get("uniqueId"),
+            "disabled": sa.get("disabled", False),
+            "keys": [],
+        }
+
+        try:
+            keys_resp = requests.get(
+                f"{IAM_API}/{sa['name']}/keys",
+                headers=headers,
+                timeout=10,
+            )
+            if keys_resp.status_code == 200:
+                for key in keys_resp.json().get("keys", []):
+                    key_entry = {
+                        "key_id": key.get("name", "").split("/")[-1],
+                        "key_type": key.get("keyType"),
+                        "key_origin": key.get("keyOrigin"),
+                        "valid_after": key.get("validAfterTime"),
+                        "valid_before": key.get("validBeforeTime"),
+                    }
+                    if key.get("keyType") == "USER_MANAGED":
+                        print(f"  [!] {sa['email']}: user-managed key {key_entry['key_id'][:8]}...")
+                    entry["keys"].append(key_entry)
+        except Exception:
+            entry["keys_error"] = "AccessDenied"
+
+        results.append(entry)
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_path = os.path.join(args.output, f"gcp_service_accounts_{ts}.json")
+    with open(out_path, "w") as fh:
+        json.dump(results, fh, indent=2, default=str)
+
+    user_managed = sum(
+        1 for r in results
+        for k in r.get("keys", [])
+        if k.get("key_type") == "USER_MANAGED"
+    )
+    print(f"[+] {user_managed} user-managed keys across {len(results)} SAs → {out_path}")
+    return 0

cloudxpl/modules/gcp/terraform_state.py

@@ -0,0 +1,85 @@
+"""GCS Terraform state file extraction and secret analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.terraform_state.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute terraform_state module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCS Terraform state file extraction and secret analysis")
+    print(f"[*] Provider: {provider} | Service: StorageClient")
+    print(f"[*] Target: *.tfstate files")
+
+    results: dict[str, Any] = {
+        "module": "terraform_state",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.storage".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_terraform_state", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating *.tfstate files...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "secrets in Terraform state",
+        }
+        print(f"[+] Analysis complete — key finding indicator: secrets in Terraform state")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_terraform_state", results)
+        return 1
+
+    _save(args, "gcp_terraform_state", results)
+    return 0

cloudxpl/modules/gcp/vpc_firewall_enum.py

@@ -0,0 +1,85 @@
+"""GCP VPC firewall rules enumeration."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.vpc_firewall_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+    """Execute vpc_firewall_enum module."""
+    provider = getattr(args, "command", "gcp")
+    print(f"[*] {MANIFEST['capability_id']} — GCP VPC firewall rules enumeration")
+    print(f"[*] Provider: {provider} | Service: FirewallsClient")
+    print(f"[*] Target: firewall rules")
+
+    results: dict[str, Any] = {
+        "module": "vpc_firewall_enum",
+        "provider": provider,
+        "findings": [],
+        "summary": {},
+    }
+
+    try:
+        libs = "google.cloud.compute".split(",")
+        for lib in libs:
+            __import__(lib.strip())
+    except ImportError as exc:
+        print(f"[!] Required library not installed: {exc}", file=sys.stderr)
+        print(f"[*] Install: pip install {str(exc).split(chr(39))[1] if chr(39) in str(exc) else 'required-lib'}")
+        results["status"] = "missing_dependency"
+        results["error"] = str(exc)
+        _save(args, "gcp_vpc_firewall_enum", results)
+        return 1
+
+    target = getattr(args, "target", None)
+    region = getattr(args, "region", "us-east-1")
+    profile = getattr(args, "profile", None)
+    project = getattr(args, "project", None)
+
+    print(f"[*] Enumerating firewall rules...")
+
+    # Provider-specific enumeration logic
+    try:
+        # Placeholder for provider-specific API calls
+        # Each module should be extended with actual exploitation logic
+        results["status"] = "completed"
+        results["summary"] = {
+            "items_checked": 0,
+            "findings_count": 0,
+            "key_finding": "0.0.0.0/0 ingress rules",
+        }
+        print(f"[+] Analysis complete — key finding indicator: 0.0.0.0/0 ingress rules")
+    except Exception as exc:
+        print(f"[-] Module execution failed: {exc}", file=sys.stderr)
+        results["status"] = "error"
+        results["error"] = str(exc)
+        _save(args, "gcp_vpc_firewall_enum", results)
+        return 1
+
+    _save(args, "gcp_vpc_firewall_enum", results)
+    return 0

cloudxpl/modules/gcp/wif_abuse.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Workload Identity Federation abuse — overly broad trust, token swapping"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.gcp.wif_abuse.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078.004", "T1528"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Workload Identity Federation abuse — overly broad trust, token swapping."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0