mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 07:29:04 -08:00
182 lines
11 KiB
Markdown
182 lines
11 KiB
Markdown
# GCP - Logging Enum
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
## Basic Information
|
||
|
||
This service allows users to store, search, analyze, monitor, and alert on **log data and events** from GCP.
|
||
|
||
Cloud Logging is fully integrated with other GCP services, providing a centralized repository for logs from all your GCP resources. It **automatically collects logs from various GCP services** like App Engine, Compute Engine, and Cloud Functions. You can also use Cloud Logging for applications running on-premises or in other clouds by using the Cloud Logging agent or API.
|
||
|
||
Key Features:
|
||
|
||
* **Log Data Centralization:** Aggregate log data from various sources, offering a holistic view of your applications and infrastructure.
|
||
* **Real-time Log Management:** Stream logs in real time for immediate analysis and response.
|
||
* **Powerful Data Analysis:** Use advanced filtering and search capabilities to sift through large volumes of log data quickly.
|
||
* **Integration with BigQuery:** Export logs to BigQuery for detailed analysis and querying.
|
||
* **Log-based Metrics:** Create custom metrics from your log data for monitoring and alerting.
|
||
|
||
### Logs flow
|
||
|
||
<figure><img src="../../../.gitbook/assets/image (3) (1) (1).png" alt=""><figcaption><p><a href="https://betterstack.com/community/guides/logging/gcp-logging/">https://betterstack.com/community/guides/logging/gcp-logging/</a></p></figcaption></figure>
|
||
|
||
Basically the sinks and log based metrics will device where a log should be stored.
|
||
|
||
### Configurations Supported by GCP Logging
|
||
|
||
Cloud Logging is highly configurable to suit diverse operational needs:
|
||
|
||
1. **Log Buckets (Logs storage in the web):** Define buckets in Cloud Logging to manage **log retention**, providing control over how long your log entries are retained.
|
||
* By default the buckets `_Default` and `_Required` are created (one is logging what the other isn’t).
|
||
* **\_Required** is:
|
||
|
||
{% code overflow="wrap" %}
|
||
````
|
||
```bash
|
||
LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
|
||
```
|
||
|
||
````
|
||
{% endcode %}
|
||
|
||
* **Retention period** of the data is configured per bucket and must be **at least 1 day.** However the **retention period of \_Required is 400 days** and cannot be modified.
|
||
* Note that Log Buckets are **not visible in Cloud Storage.**
|
||
|
||
2. **Log Sinks (Log router in the web):** Create sinks to **export log entries** to various destinations such as Pub/Sub, BigQuery, or Cloud Storage based on a **filter**.
|
||
* By **default** sinks for the buckets `_Default` and `_Required` are created:
|
||
* ```bash
|
||
_Required logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Required LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
|
||
_Default logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Default NOT LOG_ID("cloudaudit.googleapis.com/activity") AND NOT LOG_ID("externalaudit.googleapis.com/activity") AND NOT LOG_ID("cloudaudit.googleapis.com/system_event") AND NOT LOG_ID("externalaudit.googleapis.com/system_event") AND NOT LOG_ID("cloudaudit.googleapis.com/access_transparency") AND NOT LOG_ID("externalaudit.googleapis.com/access_transparency")
|
||
```
|
||
* **Exclusion Filters:** It's possible to set up **exclusions to prevent specific log entries** from being ingested, saving costs, and reducing unnecessary noise.
|
||
3. **Log-based Metrics:** Configure **custom metrics** based on the content of logs, allowing for alerting and monitoring based on log data.
|
||
4. **Log views:** Log views give advanced and **granular control over who has access** to the logs within your log buckets.
|
||
* Cloud Logging **automatically creates the `_AllLogs` view for every bucket**, which shows all logs. Cloud Logging also creates a view for the `_Default` bucket called `_Default`. The `_Default` view for the `_Default` bucket shows all logs except Data Access audit logs. The `_AllLogs` and `_Default` views are not editable.
|
||
|
||
It's possible to allow a principal **only to use a specific Log view** with an IAM policy like:
|
||
|
||
{% code overflow="wrap" %}
|
||
```json
|
||
{
|
||
"bindings": [
|
||
{
|
||
"members": [
|
||
"user:username@gmail.com"
|
||
],
|
||
"role": "roles/logging.viewAccessor",
|
||
"condition": {
|
||
"title": "Bucket reader condition example",
|
||
"description": "Grants logging.viewAccessor role to user username@gmail.com for the VIEW_ID log view.",
|
||
"expression":
|
||
"resource.name == \"projects/PROJECT_ID/locations/LOCATION/buckets/BUCKET_NAME/views/VIEW_ID\""
|
||
}
|
||
}
|
||
],
|
||
"etag": "BwWd_6eERR4=",
|
||
"version": 3
|
||
}
|
||
```
|
||
{% endcode %}
|
||
|
||
### Default Logs
|
||
|
||
By default **Admin Write** operations (also called Admin Activity audit logs) are the ones logged (write metadata or configuration information) and **can't be disabled**.
|
||
|
||
Then, the user can enable **Data Access audit logs**, these are **Admin Read, Data Write and Data Write**.
|
||
|
||
You can find more info about each type of log in the docs: [https://cloud.google.com/iam/docs/audit-logging](https://cloud.google.com/iam/docs/audit-logging)
|
||
|
||
However, note that this means that by default **`GetIamPolicy`** actions and other read actions are **not being logged**. So, by default an attacker trying to enumerate the environment won't be caught if the sysadmin didn't configure to generate more logs.
|
||
|
||
To enable more logs in the console the sysadmin needs to go to [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit) and enable them. There are 2 different options:
|
||
|
||
* **Default Configuration**: It's possible to create a default configuration and log all the Admin Read and/or Data Read and/or Data Write logs and even add exempted principals:
|
||
|
||
<figure><img src="../../../.gitbook/assets/image (338).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
* **Select the services**: Or just **select the services** you would like to generate logs and the type of logs and the excepted principal for that specific service.
|
||
|
||
Also note that by default only those logs are being generated because generating more logs will increase the costs.
|
||
|
||
### Enumeration
|
||
|
||
The `gcloud` command-line tool is an integral part of the GCP ecosystem, allowing you to manage your resources and services. Here's how you can use `gcloud` to manage your logging configurations and access logs.
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
# List buckets
|
||
gcloud logging buckets list
|
||
gcloud logging buckets describe <bucket-name> --location <location>
|
||
|
||
# List log entries: only logs that contain log entries are listed.
|
||
gcloud logging logs list
|
||
|
||
# Get log metrics
|
||
gcloud logging metrics list
|
||
gcloud logging metrics describe <metric-name>
|
||
|
||
# Get log sinks
|
||
gcloud logging sinks list
|
||
gcloud logging sinks describe <sink-name>
|
||
|
||
# Get log views
|
||
gcloud logging views list --bucket <bucket> --location global
|
||
gcloud logging views describe --bucket <bucket> --location global <view-id> # view-id is usually the same as the bucket name
|
||
|
||
# Get log links
|
||
gcloud logging links list --bucket _Default --location global
|
||
gcloud logging links describe <link-id> --bucket _Default --location global
|
||
```
|
||
{% endcode %}
|
||
|
||
Example to check the logs of **`cloudresourcemanager`** (the one used to BF permissions): [https://console.cloud.google.com/logs/query;query=protoPayload.serviceName%3D%22cloudresourcemanager.googleapis.com%22;summaryFields=:false:32:beginning;cursorTimestamp=2024-01-20T00:07:14.482809Z;startTime=2024-01-01T11:12:26.062Z;endTime=2024-02-02T17:12:26.062Z?authuser=2\&project=digital-bonfire-410512](https://console.cloud.google.com/logs/query;query=protoPayload.serviceName%3D%22cloudresourcemanager.googleapis.com%22;summaryFields=:false:32:beginning;cursorTimestamp=2024-01-20T00:07:14.482809Z;startTime=2024-01-01T11:12:26.062Z;endTime=2024-02-02T17:12:26.062Z?authuser=2\&project=digital-bonfire-410512)
|
||
|
||
There aren't logs of **`testIamPermissions`**:
|
||
|
||
<figure><img src="../../../.gitbook/assets/image (2) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
### Post Exploitation
|
||
|
||
{% content-ref url="../gcp-post-exploitation/gcp-logging-post-exploitation.md" %}
|
||
[gcp-logging-post-exploitation.md](../gcp-post-exploitation/gcp-logging-post-exploitation.md)
|
||
{% endcontent-ref %}
|
||
|
||
### Persistence
|
||
|
||
{% content-ref url="../gcp-persistence/gcp-logging-persistence.md" %}
|
||
[gcp-logging-persistence.md](../gcp-persistence/gcp-logging-persistence.md)
|
||
{% endcontent-ref %}
|
||
|
||
## References
|
||
|
||
* [https://cloud.google.com/logging/docs/logs-views#gcloud](https://cloud.google.com/logging/docs/logs-views#gcloud)
|
||
* [https://betterstack.com/community/guides/logging/gcp-logging/](https://betterstack.com/community/guides/logging/gcp-logging/)
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|