Location

Windows

Windows:

C:\\Users\\[Username]\\AppData\\Roaming\\gcloud

Linux

~/.config/gcloud/

Steal token

• The ‘application default credentials (ADC)’ are stored in ~/.config/gcloud/application_default_credentials.json
• Cloud SDK login when running gcloud auth login (or gcloud auth activate-service-account) appends an entry in the credentials.db database. copy access_tokens.db and credentials.db into attacker host.

Once copied

gcloud auth list
gcloud config set account {account name} 
gcloud projects list