hacktricks-cloud/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md

GCP - Secret Manager Persistence

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Secret Manager

Find more information about Secret Manager in:

{% content-ref url="../gcp-services/gcp-secrets-manager-enum.md" %} gcp-secrets-manager-enum.md {% endcontent-ref %}

Rotation misuse

An attacker could update the secret to:

• Stop rotations so the secret won't be modified
• Make rotations much less often so the secret won't be modified
• Publish the rotation message to a different pub/sub
• Modify the rotation code being executed. This happens in a different service, probably in a Cloud Function, so the attacker will need privileged access over the Cloud Function or any other service.

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}