Saved Credentials on Windows (cmdkey and runas)

Windows lets users cache credentials in Credential Manager (for RDP, network shares, terminal services, etc.). An attacker with a session as that user can list them with cmdkey and reuse them with runas /savecred without ever seeing the plaintext password: the system injects it for them. It is a quiet way to move to another host or escalate to another user, and it fits into the broader hunt for secrets saved on the system.

Mechanism

List the credentials stored for the current user:

cmdkey /list

    Target: LegacyGeneric:target=TERMSRV/SQL01
    Type: Generic
    User: inlanefreight\bob

Even without seeing the password, we can run commands as that user by reusing the cached secret (for example, to spawn a reverse shell):

runas /savecred /user:inlanefreight\bob "cmd.exe /c <command>"

If the saved credential is of type TERMSRV/<host>, an RDP connection to that host will use it automatically. This technique pairs with a broader hunt for secrets: SessionGopher extracts saved PuTTY, WinSCP, FileZilla and RDP sessions; LaZagne sweeps dozens of programs; SharpChrome logins /unprotect pulls browser passwords; and reg query reveals cleartext in the registry:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions

Requirements

Credential Manager is tied to the user and protected with DPAPI, so reading and reusing its entries requires an interactive session as that user. Accessing other users' vaults requires local administrator or SYSTEM. runas /savecred reuses whatever the current user has cached, without prompting for the password.

How to detect it

The abuse is given away by the execution of cmdkey /list and runas /savecred (event 4688 with the command line), access to Credential Manager (DPAPI activity, events 5379/16385), reads of the Winlogon or SimonTatham\PuTTY keys, and the use of known tools such as LaZagne, SessionGopher or SharpChrome.

Defence. Disable the "remember credentials" option via GPO and clear Credential Manager; use gMSA service accounts instead of cached credentials; deploy LAPS for the local administrator; and audit 4688 with command lines. Related to autologon credentials, credential hunting, credential reuse, PowerShell history and Event Log Readers.