Overview#
By now, you should already have an idea of what the general idea is. We’ve done it with AWS Cloudfront, with Cloudflare and now we’ll do exactly the same but with Google Cloud’s services.
For GCP, we will do exactly as Cloudfront’s requires it to, in addition to a mandatory Load Balancer between the redirector and the CDN.
If you followed the Cloudfront’s Blog Post you should be totally fine applying the exact same steps to get your connection up and going.
Google’s scenario#
As previously discussed we need a scenario that justifies the use of Goolge’s services when viewed by the blue team.
The most common idea I could think of is simply mimicking legit and normal internet navigation traffic to blend within normal packets.
For that here is what we’ll need:
Domain names mimicking real google analytics or basics visits: You can refer to how to pick up good domain names in Here.
Google CDN distributions and GCP ALBs to link with the redirector.
A malleable C2 profile that will define the way our implant will talk back to us by defining the headers, the URIs and how/where data is transmitted which will help our network obfuscation if our packets are analyzed.