Red Team tool for exfiltrating the target organization's Google People Directory that you have access to, via Google's People API.
Create a new Google Cloud Platform (GCP) project
Steps to get the Google API Access Token needed for connecting to the API
Down arrow. A dialog listing current projects appears.
New Project. The New Project screen appears.
Project Name field, enter a descriptive name for your project.
Project ID, click
Edit. The project ID can't be changed after the project is created, so choose an ID that meets your needs for the lifetime of the project.
Create. The console navigates to the Dashboard page and your project is created within a few minutes.
Enable a Google Workspace API
Down arrowand select the project you just created from the dropdown list.
APIs & Services.
Enable APIs and Services. The
Welcome to API Librarypage appears.
search field, enter "People".
Enable. The Overview page appears.
Configure OAuth Consent screen
Credentials. The credential page for your project appears.
Configure Consent Screen. The "OAuth consent screen" screen appears.
Externaluser type for your app.
Create. A second "OAuth consent screen" screen appears.
User support emailfield.
Developer contact informationfield.
Save and Continue. The "Scopes" page appears.
Add or Remove Scopes. The "Update selected scopes" page appears.
Google Peoplescopes to use in the app.
Update. A list of scopes for your app appears.
Save and Continue. The "Edit app registration" page appears.
Save and Continue. The "OAuth consent screen" appears.
Create a credential
Create Credentialsand select
OAuth client ID. The "Create OAuth client ID" page appears.
namefield, type a name for the credential. This name is only shown in the Cloud Console.
Create. The OAuth client created screen appears. This screen shows the
OK. The newly created credential appears under "OAuth 2.0 Client IDs."
downloadbutton to the right of the newly-created OAuth 2.0 Client ID. This copies a client secret JSON file to your desktop. Note the location of this file.
Add the victim's Google account to the Application's Test Users
In order to be able to run this script against the victim, you will need to add their Google account to the Test Users list for the App you just created
OAuth consent screen. You "OAuth Consent Screen" page appears.
Test Usersclick the
First Time running gdir_thief
Upon gaining access to a Target's Google account, you can run gdir_thief
Google API Libraries:
pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib
usage: python3 gdir_thief.py [-h] help: This Module will connect to Google's People API using an access token and exfiltrate the organization's People directory. It will output a CSV file to ./loot/directory.csv