alekonko alekonko

0.1. References
0.2. Other cheatsheets
0.3. Manage multiple gcloud config configurations
- 0.3.1. Switch gcloud context with gcloud config
0.4. Credentials
0.5. info
0.6. projects
0.7. zones & regions
0.8. Organization
0.9. billing

Purpose

*Most pentesting and gcp privilege escalation stuff out there for GCP assumes what I'm finding to be an absurd level of access handed to you.(i.e Human 2fa protected accounts, organization-wide read only IAM perms, etc that is not suitable for use in black box testing of mature environments.
There's a lot of data you need to use the gcp api only available behind mandatory 2fa protected human accounts that service accounts and low tier project accounts simply do not have access to enumerating if you find yourself having popped an application or shelled a instance somehow and have console-only access.

Intent of this is to break down various categories of escalation that will be available to service accounts, as well as point out various showstoppers.

0.1. References
0.2. Other cheatsheets
0.3. Manage multiple gcloud config configurations
[0.3.1. Switch gcloud context with gcloud config](#031

My Openshift Cheatsheet

Openshift build secrets for cloning git repos using SSH Keys

To create ssh secret:

oc create secret generic sshsecret \
    --from-file=ssh-privatekey=$HOME/.ssh/id_rsa

Common Options

-#, --progress-bar Make curl display a simple progress bar instead of the more informational standard meter.

-b, --cookie <name=data> Supply cookie with request. If no =, then specifies the cookie file to use (see -c).

-c, --cookie-jar <file name> File to save response cookies to.

	# __ __
	# __ ______ ____ ___ ____ _/ /____ ____ ____/ /
	# / / / / __ \/ __ `__ \/ __ `/ __/ _ \/ __ \/ __ /
	# / /_/ / /_/ / / / / / / /_/ / /_/ __/ /_/ / /_/ /
	# \__, /\____/_/ /_/ /_/\__,_/\__/\___/\____/\__,_/
	# /____ matthewdavis.io, holla!
	#
	FROM node:9.2-alpine

	ENV GOPATH /go

	terraform {
	required_version = ">= 0.12.0"
	}

	provider "aws" {
	region = "us-east-1"
	}

	resource "aws_vpc" "my_vpc" {
	cidr_block = "172.16.0.0/16"

	https://cloud.google.com/storage/docs/encryption/

	BUCKET_NAME=YOUR_NAME_enron_corpus
	gsutil mb gs://${BUCKET_NAME}

	gsutil cp gs://enron_corpus/allen-p/inbox/1. .
	tail 1.

	Enable API/Create keyring
	gcloud services enable cloudkms.googleapis.com

	#!/usr/bin/env bash

	# REF: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations

	export PROJECT_ID=$(gcloud config get-value project)
	export PROJECT_USER=$(gcloud config get-value core/account) # set current user
	export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format="value(projectNumber)")
	export IDNS=${PROJECT_ID}.svc.id.goog # workflow identity domain

	export GCP_REGION="us-west4" # CHANGEME (OPT)

	#!/bin/bash
	# ocp4-download-clients v0.2.0 last mod 2020/01/23
	# Copyright 2020 Ryan Sawhill Aroha <[email protected]>
	#
	# This program is free software: you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation, either version 3 of the License, or
	# (at your option) any later version.
	#
	# This program is distributed in the hope that it will be useful,

	#!/bin/bash
	#
	# This extremely rough nonsense is an attempt to automate the disaster recovery
	# expired certs documentation published at
	# https://docs.openshift.com/container-platform/4.1/disaster_recovery/scenario-3-expired-certs.html
	# ... Which was last reviewed on 2019/06/10
	#
	# Please contact [email protected] with suggestions or corrections

	# CUSTOMIZE THESE: