alexlee820/cve-2025-63946-tencent-pc-manager-eopProof-of-concept exploit for CVE-2025-63946, a local privilege escalation in Tencent PC Manager via symlink attacks on temporary directories, achieving arbitrary file deletion as SYSTEM.
version: PCManager Version lower or equal 17.10.28554.205
Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link (symlink) attacks to coerce a SYSTEM-privileged process into deleting arbitrary files, resulting in local privilege escalation.During the scan process, QQPCRtp.exe, running under NT AUTHORITY\SYSTEM, moves the scanned files into this temporary directory and deletes them after the scan completes.
It was observed the process "QQPCRTP.exee" will do the following with SYSTEM privilege when we start scanning the drive:
QQPCRTP.exe creates a subdirectory named with a uuid (e.g., {*}) inside pcmgr_scan_tmp.
At the end, QQPCRTP.exe uses SYSTEM privileges to delete the {*} subdirectory inside pcmgr_scan_tmp.
Since the directory "C:\Windows\Temp_pcmgr_scan_tmp_" could be created by current user and assigned with "Modify" privilege for current user, current user could modify and read the entire directory. With this setup, an unprivileged user is able to achieve arbitrary file delete by creating a symbolic link to a privileged location (e.g., C:\Windows\System32). Furthermore, a malicious user could achieve local privilege escalation from arbitrary file/folder delete.
I also do not really know when will the Tencent PC Manager create the pcmgr_scan_tmp folder so we need to win the race condition to create the pcmgr_scan_tmp folder on Windows\Temp . Otherwise you can perform this exploit until the PC Manager re-install
To perform LPE by arbitrary file/folder delete , the user could perform follow steps:
User create folder "C:\Windows\Temp\TencentDownload"
User set OpLock on folder "C:\Windows\Temp_pcmgr_scan_tmp_{}" once we observe the any {} folder are created
The process "QQPCRTP.exe" will attempt to remove folder "C:\Windows\Temp_pcmgr_scan_tmp_{*}" with SYSTEM privilege.
The process "QQPCRTP.exe" will be paused due to the OpLock
When OpLock is triggered, user move file "C:\Windows\Temp_pcmgr_scan_tmp_{*}" to somewhere else to empty the folder
User create junction "C:\Windows\Temp_pcmgr_scan_tmp_{*}" to "\RPC Control"
User create symbolic link "GLOBAL\GLOBALROOT\RPC Control{*}" to target folder/file (e.g., C:\Windows\System32\secrets)
User release OpLock
User delete symbolic link
Target file/folder (e.g., C:\Windows\System32\secrets) would be deleted
PoC video :https://drive.google.com/file/d/1-8GngjK97cnfqHw0cB_GncUxzLLR2wpF/view?usp=sharing
