> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/runas.md).

# Runas

Allows a user to run specific tools and programs with different permissions than the user's current logon provides.

```
cmdkey /list
```

* `cmdkey`: A native Windows command-line utility used to create, list, and delete stored usernames and passwords or credentials.
* `/list`: The specific switch that instructs the utility to display all credentials currently stored on the local computer for the logged-in user.

The primary utility of this command is Credential Enumeration.

In a system administration or security context, it allows a user to see what cached credentials are saved for various targets, such as network shares, domain controllers, or remote desktop connections. As seen in your screenshot, the system has a stored Domain Password for the user `ACCESS\Administrator`.

<figure><img src="/files/PsPqSuBXUw6ZWGqie3ep" alt=""><figcaption></figcaption></figure>

We currently have stored credentials.

```
C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c TYPE C:\Users\Administrator\Desktop\root.txt > C:\Users\security\root.txt"
```

* `runas.exe`: A command-line tool that allows a user to run specific tools and programs with different permissions than the user's current logon provides.
* `/user:ACCESS\Administrator`: Specifies the user account under which the command should run (in this case, the domain administrator for `ACCESS`).
* `/savecred`: Instructs Windows to use credentials previously saved by the user. This is critical here because it allows the command to execute without prompting for a password, leveraging the stored credentials identified in your previous `cmdkey /list` screenshot.
* `"C:\Windows\System32\cmd.exe /c ..."`: This is the argument string. It tells the system to open a command prompt, carry out the specific command following `/c`, and then terminate.
* `TYPE ... > ...`: The specific action being performed. It reads the contents of the file `root.txt` on the Administrator's desktop and redirects (copies) that text into a new file in the `security` user's directory.

The utility of this command is Privilege Escalation and Data Exfiltration.

In a security testing scenario, once you have identified that a target system has saved credentials for a high-privileged user (like a Domain Admin), you can use `runas` with the `/savecred` flag to perform actions that your current "security" user account normally wouldn't have permission to do.

**Use with Reverse Meterpreter**

If you are currently in a Windows Reverse Meterpreter shell:

1. Identify Saved Creds: You use `cmdkey /list` to see if the machine "remembers" an admin password.
2. Escalate: You run this `runas` command to bypass file permissions.
3. Capture the Flag: By copying the `root.txt` file to a directory you control, you successfully retrieve sensitive data that was restricted to the Administrator account.