skip to main content
hacking.communityplay in the sandbox.

GCP Metadata SSRF → Service-Account Token Exfil

cloud · expert · +190 XP

Scenario

A GCE-hosted image proxy fetches any URL you supply. The GCP metadata server at 169.254.169.254 hands out service-account tokens to anything on the box — including your SSRF.

Attack path

  1. Point the proxy at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token with header Metadata-Flavor: Google.
  2. Use the OAuth token against storage.googleapis.com to read the private flag bucket.
  3. The object you exfiltrate is double-wrapped for transport.

Recover the flag

The blob is base64 first, then hex. Reverse the layers in order (base64 → hex) — CyberChef 'From Base64' then 'From Hex' — to recover your per-user flag.

// graded hints — spend XP when stuck

Sign in to unlock escalating hints for this expert lab.

// captured payload · multi
61474e375a324e774c57316c6447466b595852684c584e7a636d59745a58686d615777744d7a4178587a56684e5752694d444e6a4e6a49304d58303d

Apply each step IN REVERSE ORDER: 1. Hex-decode the blob to recover the flag (each pair of hex chars = 1 byte). 2. Decode the base64 blob to recover the flag.

// this payload is unique to your account — decode it, then submit the recovered hc{...} flag below

// submit flag
// no solves yet
previous
AWS IAM PrivEsc: iam:PassRole → Lambda Escalation
// end of cloud
10 of 10 · cloud

// go deeper

// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.