GDir-Thief : Red Team Tool For Exfiltrating The Target Organization’S Google People Directory That You Have Access To, Via Google’s API

GDir-Thief is a Red Team tool for exfiltrating the target organization’s Google People Directory that you have access to, via Google’s People API.

HOW TO

Create a new Google Cloud Platform (GCP) project

Steps to get the Google API Access Token needed for connecting to the API

  • Create a burner gmail/google account
  • Login to said account
  • Navigate to the Google Cloud Console
  • Next to “Google Cloud Platform,” click the Down arrow. A dialog listing current projects appears.
  • Click New Project. The New Project screen appears.
  • In the Project Name field, enter a descriptive name for your project.
  • (Optional) To edit the Project ID, click Edit. The project ID can’t be changed after the project is created, so choose an ID that meets your needs for the lifetime of the project.
  • Click Create. The console navigates to the Dashboard page and your project is created within a few minutes.

Enable a Google Workspace API

  • Next to “Google Cloud Platform,” click the Down arrow and select the project you just created from the dropdown list.
  • In the top-left corner, click Menu > APIs & Services.
  • Click Enable APIs and Services. The Welcome to API Library page appears.
  • In the search field, enter “People”.
  • Click the API to enable. The API page appears.
  • Click Enable. The Overview page appears.

Configure OAuth Consent screen

  • On the left side of the Overview page click Credentials. The credential page for your project appears.
  • Click Configure Consent Screen. The “OAuth consent screen” screen appears.
  • Click the External user type for your app.
  • Click Create. A second “OAuth consent screen” screen appears.
  • Fill out the form:
    • Enter an Application Name in the App name field
    • Enter your burner email address in the User support email field.
    • Enter your burner email address in the Developer contact information field.
  • Click Save and Continue. The “Scopes” page appears.
  • Click Add or Remove Scopes. The “Update selected scopes” page appears.
  • Check all of the Google People scopes to use in the app.
  • Click Update. A list of scopes for your app appears.
  • Click Save and Continue. The “Edit app registration” page appears.
  • Click Save and Continue. The “OAuth consent screen” appears.

Create a credential

  • Click Create Credentials and select OAuth client ID. The “Create OAuth client ID” page appears.
  • Click the Application type drop-down list and select Desktop Application.
  • In the name field, type a name for the credential. This name is only shown in the Cloud Console.
  • Click Create. The OAuth client created screen appears. This screen shows the Client ID and Client secret.
  • Click OK. The newly created credential appears under “OAuth 2.0 Client IDs.”
  • Click the download button to the right of the newly-created OAuth 2.0 Client ID. This copies a client secret JSON file to your desktop. Note the location of this file.
  • Rename the client secret JSON file to “credentials.json” and move it to the gdir_thief/credentials directory.

Add the victim’s Google account to the Application’s Test Users

In order to be able to run this script against the victim, you will need to add their Google account to the Test Users list for the App you just created

  • On the Left side of the screen click OAuth consent screen. You “OAuth Consent Screen” page appears.
  • Under Test Users click the Add Users button.
  • Enter the vicim’s Gmail address in the email address field.
  • Click the save button.

First Time running gdir_thief

Upon gaining access to a Target’s Google account, you can run gdir_thief

  • The first time running gdir_thief, the script opens a new window prompting you to authorize access to your data:
    • If you are not already signed in to your Google account, you are prompted to sign in. If you are signed in to multiple Google accounts, you are asked to select one account to use for the authorization. Make sure you select the victim’s Google account

Dependencies

Google API Libraries: pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib

Usage

usage:
python3 gdir_thief.py [-h]
help:
This Module will connect to Google’s People API using an access token and exfiltrate the organization’s
People directory. It will output a CSV file to ./loot/directory.csv

R K

Recent Posts

PatchWerk : A Tool For Cleaning NTDLL Syscall Stubs

PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall…

3 hours ago

Modern Network Fingerprinting : HASSH And JA4+SSH Tools

Network fingerprinting is a critical technique for identifying and analyzing network traffic patterns, particularly in…

3 hours ago

HowToHunt : Unleashing The Power Of Advanced Hunting Tools

"HowToHunt" is a platform designed to assist hunters in improving their skills, planning their expeditions,…

3 hours ago

SkyFall-Pack : Infrastructure Automation For C2 Operations

SkyFall-Pack is an advanced infrastructure automation toolkit designed for Command and Control (C2) operations. It…

3 hours ago

LummaC2 Stealer : Unpacking The Threats Of A Marketed ‘Premium’ Malware

LummaC2 is a commodity malware designed as an information stealer, targeting browsers, cryptocurrency wallets, and…

3 hours ago

RustOwl : A Visualization Tool For Ownership And Lifetime

RustOwl is an innovative tool designed to enhance the Rust programming experience by visualizing ownership…

3 hours ago