Windows Privilege Escalation: Stored Credentials (Runas)

“Stored Credentials Exploitation is a technique attackers use to escalate their access seamlessly. The Windows Credential Manager acts as a digital vault, but if an administrator has cached their credentials, an attacker can extract that privilege linearly without ever knowing the password.”

Windows would rather you never typed a password twice. Mapped drives, admin tools, scheduled jobs—it caches the credentials in the Credential Manager so the prompt stops appearing. Convenient, until an attacker lands on the box and finds an admin’s password sitting in that vault, usable without ever being cracked. Windows Privilege Escalation: Stored Credentials (Runas) walks the exact steps: find the cached token, borrow it, and step up to Administrator or SYSTEM.

Enumerating the Digital Vault

Standard users reach the vault through the Control Panel; a remote operator works from the shell. The first move is one native command: cmdkey /list.

What you are reading the output for is a stored credential tied to Administrator or a Domain Admin account. That single line tells you the machine is holding a privileged token you can spend—no cracking, no hash, no password on screen.

Weaponizing the Runas Binary

There is no hash to crack here—the whole technique lives inside native Windows. The guide abuses runas.exe, and specifically the /savecred flag, which tells the OS to pull the cached password itself.

Chained together, the sequence is short:

1. Payload Generation: Build a reverse-shell executable (shell.exe) with msfvenom and drop it into the target’s Downloads folder via a PowerShell web request.
2. Context Switching: Run it under the borrowed identity: runas /savecred /user:WORKGROUP\Administrator shell.exe.
3. Privilege Escalation: /savecred makes the OS supply the cached password itself, so the shell fires in the Administrator’s security context—and the attacker never typed the password, never even saw it.

Who Is This Book REALLY For?

• Penetration Testers: Run cmdkey /list during initial enumeration, every time. Where an admin cached the wrong credential, SYSTEM is two commands away.
• System Administrators: The concrete reason never to save high-privilege credentials on an ordinary user’s workstation—it is not a policy nicety, it is this exact attack.
• EDR Analysts: The behavioural signature to alert on—cmdkey enumeration followed closely by a runas that spawns a network-connecting binary—which almost always means someone is riding a stored token.

The Bottom Line

Windows Privilege Escalation: Stored Credentials (Runas) shows how much administrative convenience can cost. Caching a password to save a few seconds a day quietly builds a native, authentication-free path from low-privileged user to Administrator—no exploit required, just the feature working as designed.