# GCP Lateral Movement — gitlab_pharmalink_id
# Date: 2026-09-04

## Unique Service Accounts

| Project | Email | Files | Status |
|---------|-------|-------|--------|
| cfu-main | storage-innopharm-prod@cfu-main.iam.gserviceaccount.com | 2 | LIVE |
| innopharm-main | virtue-iot-healthcare-uploader@innopharm-main.iam.gserviceaccount.com | 3 | LIVE |
| monitoringlogs-bfc19 | firebase-adminsdk-fbsvc@monitoringlogs-bfc19.iam.gserviceaccount.com | 2 | LIVE |
| neogenesis-1 | crawler-pharmalink-id@neogenesis-1.iam.gserviceaccount.com | 2 | LIVE |
| virtue-panakea | virtue-iot-healthcare-uploader@virtue-panakea.iam.gserviceaccount.com | 1 | LIVE |

## Cloud SQL Instances (7 found)

| Instance | Version | Users | Hashes |
|----------|---------|-------|--------|
| colosseum | 5.7.44-google-log | 26 | 24 |
| golden-gate | 5.7.44-google-log | 20 | 18 |
| innopharm | 8.0.31-google | 24 | 14 |
| konsinyasi | 8.0.31-google | 29 | 19 |
| logistic | 8.0.31-google | 54 | 44 |
| vietnam (May-5th) | 8.4.4-google | 14 | 0 |
| vietnam (migrate) | 8.0.18-google | 21 | 11 |

## Total MySQL Hashes: 124 unique

### Shared Hashes (2+ instances)

| Hash | Instances | Users |
|------|-----------|-------|
| *496EA5CFCA9AAC8586F25EDE8311DFFAF99F5D8B | 5 | root@colosseum, golden-gate, innopharm, konsinyasi, vietnam |
| *550F43B94ABE7399FADE717A7A5FA67160F298A8 | 2 | michael_tjitra@colosseum, golden-gate |
| *0C77432076065ED8C649352D2232572522802162 | 2 | ?@golden-gate, ?@logistic |

### Known Passwords

| Hash | Password | Users |
|------|----------|-------|
| *550F43B94ABE7399FADE717A7A5FA67160F298A8 | d3v3l0p8015 | michael_tjitra, PharmanetBois, susan |
| *496EA5CFCA9AAC8586F25EDE8311DFFAF99F5D8B | ? | root (multiple instances) |
| *97EB069493563805670ED912CD7C9E8574543F99 | ? | devsecops (multiple) |

## Lateral Movement Options

### 1. Cloud SQL Access
| Method | Status |
|--------|--------|
| Direct TCP | ❌ Filtered |
| Via GCS dump | ✅ Already have |
| Via pivot | ⚠️ Need GKE/k8s |

### 2. GCS → Compute
| Method | Status |
|--------|--------|
| Startup script | Check buckets |
| Image in bucket | Check |
| Metadata server | Need instance |

### 3. Firebase → Auth
| Method | Status |
|--------|--------|
| Admin SDK | monitoringlogs-bfc19 |
| User management | Possible |
| Custom token | Possible |

### 4. BigQuery
| Method | Status |
|--------|--------|
| Dataset access | Check |
| Query jobs | Check |

## Next Steps

1. **Check GCS for compute artifacts** — startup scripts, images
2. **Check Firebase Auth** — user management
3. **Check BigQuery** — datasets
4. **Check Cloud Functions** — source in buckets
5. **Check Cloud Build** — triggers, history

## Files

- `gcp_keys/` — 10 key files (5 unique SAs)
- `gcp_sa_validation_aug14.json` — Validation results
- `gcp_scope_enum_aug14.json` — Scope enumeration
- `downloads/all/cfu-main-sql-migrate/` — 119 SQL dumps (7 instances)