Pcwrun.exe

Program Compatibility Wizard

Paths

  • C:\Windows\System32\pcwrun.exe

Commands

Execute

Open the target .EXE file with the Program Compatibility Wizard.

Use case: Proxy execution of binary

Privileges: User

Pcwrun.exe {PATH_ABSOLUTE:.exe}

Execute

Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

Use case: Proxy execution of binary

Privileges: User

Pcwrun.exe /../../$(calc).exe

Detection

Resources