patchy: Automated Persistence and Lateral Movement using GCP Patch Management
Patchy
Automated lateral movement and persistence by abusing GCP OS patch management based on my blog post.
OS patch management is a service provided by Google Cloud Platform (GCP) to enable users of the platform to update and manage long-running Virtual Machines (VMs). Updates are in the form of a user-defined bash or PowerShell scripts that can either be referenced locally or referenced via a storage bucket. One of the main features it has is scheduling where you can determine how often an update occurs and across what systems. One important thing to note is that patch management can occur on both Windows and Linux VMs.
As an attacker, this seems like a fantastic opportunity to gain a cross-platform and reliable way of getting code execution across every compute instance. It also runs under the context of the OS Config agent.
Patchy is made up of two main modes, lateral movement, and persistence. Persistence uses valid service account credentials to create a patch job or deployment. Lateral movement attempts to gain access to all the compute instances within a project. For it to be used, it must be within a GCP environment with the metadata API available. Lateral movement has a mode that enables it to see if exploitation is possible without attempting anything aggressive (good to see if your environment is secure).
