# GCP - Serviceusage Privesc

{{#include ../../../banners/hacktricks-training.md}}

## serviceusage

Die volgende permissies is nuttig om API keys te skep en te steel, nie dit vanaf die docs nie: _An API key is a simple encrypted string that **identifies an application without any principal**. They are useful for accessing **public data anonymously**, and are used to **associate** API requests with your project for quota and **billing**._

Daarom kan jy met 'n API key daardie maatskappy laat betaal vir jou gebruik van die API, maar jy sal nie escalate privileges nie.

To learn other permissions and ways to generate API keys check:

{{#ref}}
gcp-apikeys-privesc.md
{{#endref}}

### `serviceusage.apiKeys.create`

An undocumented API was found that can be used to **create API keys:**

<details><summary>Skep API key using undocumented API</summary>
```bash
curl -XPOST "https://apikeys.clients6.google.com/v1/projects/<project-uniq-name>/apiKeys?access_token=$(gcloud auth print-access-token)"
```
</details>

### `serviceusage.apiKeys.list`

Nog 'n ongedokumenteerde API is gevind om API keys wat reeds geskep is te lys (die API keys verskyn in die antwoord):

<details><summary>Lys API keys met ongedokumenteerde API</summary>
```bash
curl "https://apikeys.clients6.google.com/v1/projects/<project-uniq-name>/apiKeys?access_token=$(gcloud auth print-access-token)"
```
</details>

### **`serviceusage.services.enable`** , **`serviceusage.services.use`**

Met hierdie toestemmings kan 'n aanvaller nuwe dienste in die projek aktiveer en gebruik. Dit kan 'n **aanvaller toelaat om 'n diens soos admin of cloudidentity te aktiveer** om te probeer toegang te kry tot Workspace-inligting, of ander dienste om toegang tot interessante data te kry.

## **Verwysings**

- [https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/](https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/)

<details>

<summary><strong>Ondersteun HackTricks en kry voordele!</strong></summary>

Werk jy by 'n **kuberveiligheidsmaatskappy**? Wil jy hê jou **maatskappy in HackTricks geadverteer** moet word? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of HackTricks in PDF**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!

Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)

Kry die [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)

**Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) of die [**telegram group**](https://t.me/peass) of **volg** my op **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**

**Deel jou hacking tricks deur PRs in te stuur na die** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)\*\*\*\*

**.**

</details>



{{#include ../../../banners/hacktricks-training.md}}
