# GCP - Berging Ongeauthentiseerde Enum

{{#include ../../../../banners/hacktricks-training.md}}

## Berging

Vir meer inligting oor Berging, kyk:

{{#ref}}
../../gcp-services/gcp-storage-enum.md
{{#endref}}

### Publieke Emmer Brute Force

Die **formaat van 'n URL** om toegang tot 'n emmer te verkry is **`https://storage.googleapis.com/<bucket-name>`.**

Die volgende gereedskap kan gebruik word om variasies van die gegewe naam te genereer en te soek na verkeerd geconfigureerde emmers met daardie name:

- [https://github.com/RhinoSecurityLabs/GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute)

**Ook die gereedskap** genoem in:

{{#ref}}
../
{{#endref}}

As jy vind dat jy **toegang tot 'n emmer** kan verkry, mag jy in staat wees om **nog verder te eskaleer**, kyk:

{{#ref}}
gcp-public-buckets-privilege-escalation.md
{{#endref}}

### Soek Oop Emmers in Huidige Rekening

Met die volgende skrip [bymekaar gemaak van hier](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_buckets.sh) kan jy al die oop emmers vind:
```bash
#!/bin/bash

############################
# Run this tool to find buckets that are open to the public anywhere
# in your GCP organization.
#
# Enjoy!
############################

for proj in $(gcloud projects list --format="get(projectId)"); do
echo "[*] scraping project $proj"
for bucket in $(gsutil ls -p $proj); do
echo "    $bucket"
ACL="$(gsutil iam get $bucket)"

all_users="$(echo $ACL | grep allUsers)"
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"

if [ -z "$all_users" ]
then
:
else
echo "[!] Open to all users: $bucket"
fi

if [ -z "$all_auth" ]
then
:
else
echo "[!] Open to all authenticated users: $bucket"
fi
done
done
```
{{#include ../../../../banners/hacktricks-training.md}}
