Windows Saved Credentials (cmdkey / runas /savecred)

Windows Credential Manager stores user-supplied credentials for network resources, RDP targets, and mapped drives. Two built-in commands expose the store’s attack surface (MITRE ATT&CK T1555.004 — Credentials from Password Stores: Windows Credential Manager):

cmdkey /list

lists every saved credential under the current user’s context — targets, types (Domain Password, Generic), and usernames. Entries like Target: DOMAIN\Administrator or Domain:interactive=... indicate a privileged account has been cached.

runas /savecred /user:DOMAIN\Administrator "cmd.exe"

launches a program using the stored credential without prompting for the password. The stored secret is never displayed — but it doesn’t need to be: /savecred hands it to the logon API on your behalf. If an admin ever ticked “remember me” for their runas or RDP session on this box, any code running as that user (even a low-privileged webshell context that can reach the interactive user’s session) gets an instant privilege escalation with a built-in binary.

Enumeration and exploitation flow

1. cmdkey /list — look for Administrator, SYSTEM, service accounts, or Domain:interactive entries. No entries → technique does not apply.
2. runas /savecred /user:<found_user> "C:\path\payload.exe" — execute as the cached user. Works for net user/net localgroup additions, reverse shells, or an elevated cmd.exe.
3. GUI equivalent: rundll32.exe keymgr.dll,KRShowKeyMgr opens the classic Stored User Names and Passwords dialog.
4. Extraction (as opposed to use): Mimikatz sekurlsa::credman can pull the actual secrets from LSASS memory when executed with debug privileges — the difference between using a credential and stealing it for offline reuse.

Caveats

• cmdkey /list only shows credentials saved under the current user profile. Saved creds belonging to other interactive users require code execution in their sessions.
• runas /savecred spawns the new process attached to the current session — payloads that need a service context (Session 0) should pivot through a service/scheduled task instead; see windows-services.
• Modern mitigations (Credential Guard, WDAC) restrict LSASS extraction, but do nothing about legitimate runas /savecred use — the store working as designed is the vulnerability.

Detection

• Process creation events: cmdkey /list from unexpected accounts (Sysmon EID 1), runas.exe with /savecred in command line.
• Credential Manager access by non-system processes (ETW/EDR telemetry).
• Baseline admin behavior — saved admin credentials on servers are themselves a finding.

Related

• runas-command — the full runas reference, including /netonly and the blind-elevation caveat
• unattended-installation-credentials — file-based leftover credentials, the other classic host-side find
• windows-reconnaissance-commands — cmdkey /list in the recon command table (T1555)
• ntlm-relay-attacks — what happens after credentials are recovered
• putty-saved-sessions — application-level credential storage in the registry

Sources

• Credentials from Password Stores: Windows Credential Manager — MITRE ATT&CK T1555.004
• Runas — Microsoft Learn
• cmdkey — Microsoft Learn
• Windows Privilege Escalation – Runas (Stored Credentials) — Stefano Lanaro