Video summary
A critical vulnerability has been discovered in the Windows version of Steam that allows a standard user account to silently escalate privileges to full system access. This local privilege escalation flaw means that even without remote code execution capabilities, an attacker who gains initial access to a machine can leverage the Steam client service, which runs with the highest "Local System" privileges, to execute arbitrary commands as the NT Authority\System user. The proof of concept demonstrates how this works by creating a low-privilege user account and utilizing the Steam installer to ensure the necessary service is running. Once the service is active, the exploit triggers an Inter-Process Communication (IPC) request that tricks the system into adding a malicious script to its allow list, effectively bypassing standard security controls and granting the attacker complete control over the operating system.
The technical implementation of this exploit involves manipulating the Steam client's IPC mechanism, specifically targeting how it handles signed Valve Data Format files for applications like Wallpaper Engine. The original proof of concept code was heavily obfuscated and contained extensive boilerplate logic, leading the researcher to suspect it was generated or significantly assisted by AI tools rather than written manually. Upon analyzing the source code, it became clear that the exploit relies on specific SHA-256 hashes and signed install scripts to trick the Steam service into executing a payload from a directory chosen by the attacker. While Windows Defender initially blocked the execution of the compiled binary, disabling the antivirus allowed the exploit to successfully launch a system shell, confirming that the vulnerability is real and exploitable in environments where such defenses might be bypassed or delayed.
In an effort to simplify the attack chain, the researcher stripped away much of the unnecessary complexity from the original codebase to create a more streamlined version using primarily PowerShell scripts. This refined approach eliminates the need for a custom-compiled C++ binary by instead utilizing "Living off the Land" binaries like cmd.exe directly within the payload. The simplified method still involves creating a modified, signed VDF file that points to an attacker-controlled directory containing the desired executable, which is then invoked through the Steam IPC interface. This reduction in complexity highlights how modern AI tools can automate the tedious aspects of vulnerability research and exploit development, allowing researchers to focus on the core logic rather than writing thousands of lines of boilerplate code to interact with system APIs.
The broader implications of this discovery extend beyond the specific mechanics of the Steam exploit, touching on the rapidly evolving landscape of cybersecurity and artificial intelligence. The researcher notes that AI is now being used not just by defenders but also by offensive researchers to generate exploits, analyze malware, and compress complex attack chains into concise scripts. This shift suggests that the timeline for discovering and weaponizing vulnerabilities is shrinking, as machines can now perform tasks previously reserved for human experts with greater speed and efficiency. Ultimately, while the specific details of this exploit may be abstracted away by AI, the fundamental risk remains: if a vulnerability exists, it will eventually be found and exploited, making the binary question of whether a system is vulnerable far more critical than the intricacies of how that vulnerability was discovered.
Read the full video transcript
Breaking. A Steam vulnerability on
Windows lets any normal user silently
escalate to full system privileges.
There's a little video attached below.
Credits to Killa and the proof of
concept can be found down below in the
comments. Now, I saw this post the other
night and it caught my interest because
hey, vulnerability in Steam. That sounds
like something people might start
chirping about. It looks like Killa
might be the individual that I don't
know carried this forward. Here is uh
Killa. Okay, but let's take a look at
the proof of concept. They have the
GitHub repository linked here. Now, I
got to say, whenever something like this
pops up, whatever vulnerability, zero
day, exploit, proof of concept, malware
sample, whatever, I don't know, just
ends up on GitHub, the very first thing
that I do is uh download the code uh
just because look, I want it. I want a
copy. I want a backup just in case this
thing falls off the face of the
internet. It's happened before. I like
to go ahead and download just about
everything that I can so that I have it
available for me. But we can start the
party pretty quick. I'm here on my
Windows 11 virtual machine and we can
take a look at how this proof of concept
exploit works. And can we see this thing
in action? We can try and run it. Now I
am logged in as a user that is a member
of the local administrators groups. Now
let me tell you this exploit is a local
privilege escalation vulnerability. an
exploit. It's so that a standard user,
Joe Schmo, could become NT authority
system even higher than the
administrator. That does mean that you
still need to have initial access. A lot
of folks are whining a little bit about
that because it's like, oh, it's not
remote code execution, but I think
there's still a little bit of value in
understanding that look, a local
privilege escalation vulnerability is
still pretty valid. Let me go ahead and
add a new user for us. But of course,
this uh does not have the user account
control popup. So, we're going to close
out of that terminal, open just another
one with those admin privileges so we
could add that user and have something
for us to work with and demo this. On
top of that, I do have the Steam
installer so we can get Steam installed
here just for the quick convenience
because we will be switching into that
new lowprivilege John user. I set these
up in the public downloads folder, but
let's go ahead and install the latest
version of Steam so that we'll see this
in action. Steam takes a little bit of
time to fully install, but the proof of
concept is targeting version
10.96.30.42.
I'm looking over my notes on the other
monitor. I believe that is still the
latest version of Steam. But now that
that is installed, let's go ahead and
actually sign out to switch to that
lowprivilege user. With that, we can try
to validate whether or not this thing
will work for us. Yeah. Hi, Windows.
Hello. Thanks. Okay. No, please don't
stalk me. Okay. So Steam is installed.
We can see that. Go ahead and run. And
now we don't have to be signed in. We
just need the Steam client service
actually running. Remember that runs as
local system, the highest privileges. So
could we take advantage of that? Let me
bring the proof of concept to my desktop
here. And then we could try to run that
as just that lowprivilege user. You can
see that Steam is still running. But
when we fire off brokenpipe.exe,
big greets to nightmare Eclipse. We will
launch a system shell supposedly and
we'll cross our fingers and see if this
thing pops.
Takes a little bit of time. I'm trying
to fill the air.
Oh. Uh oh.
Defender. Did antivirus already hit that
thing? Yeah. Nice. What are the details
here? Oh, we can do the UAC prompt. So,
this is just borrowing the admin
privileges for a quick moment.
>> [laughter]
>> So, it tried to run Windows Antivirus.
Uh, looks like it stopped that thing.
Nice. For the sake of the showcase,
let's turn that thing off. But now you
know that. Yeah, Windows Defender will
probably nip that in the bud. Can we try
that one more time? Broken pipe.exe. Oh,
yeah. You killed it. Let's put that
right back. And let's try and run it
once again. Cross our fingers a second
time. Launching system shell.
Oh, okay. It happened. Here we go. Who
am I? Anti- authority system. All right.
LPE. Right. So, I think what we should
do is take a look through the proof of
concept, see if we can better understand
it, and then see if there is another
approach or a different way to go about
this with our new finer understanding
after we've kind of read through the
code here. It looks like there's a lot
of stuff in this package, and I wonder
could we thin it down? Since we've
downloaded the code, we can take a look
at it. And I've opened up that
repository folder here in Sublime Text.
Just a text editor that I like. I know
there is a SLN or like Microsoft Visual
Studio Solution file. I just don't care.
I'm lazy. I don't want to bother with
it. Since the release file was just aexe
or executable, we're probably going to
be looking at this CPP C++ source file.
We can start there. But before we dive
in, please let me take just a moment to
tell you about the sponsor of today's
video. Bant AI has changed how companies
build, but it's also multiplying the
security and compliance work behind the
scenes. New frameworks, audits, and
vendors keep arriving while teams are
already juggling enough. Typical
compliance tools promise automation, but
the real work still lands back on you.
Chasing screenshots, manually validating
controls, and constantly playing
catch-up when audit season rolls around.
Vanta works differently. Vanta is an
agentic trust platform built to scale
with you. With more than 1,400 automated
tests across over 400 integrations, it
continuously collects evidence and
monitors controls year round, helping
you and other teams cut audit prep time
by 82%. And you can access the Vant
agent everywhere you work, whether it's
in Claude or Cursor or other AI tools.
More than 16,000 fast-growing companies,
including Ramp, Writer, and Harvey, use
Vanta to save time as they scale. Spend
less time chasing screenshots and more
time getting work done. Check out Vanta
with my link below in the video
description at jh.live/vanta.
Huge thanks to Vanta for sponsoring this
video. All right, so let's take a look
at this C++ source code for the broken
pipe exploit. A little steam local
privilege escalation. Now, the first
handful of these includes are just kind
of standard library things. Uh, you can
tell by the greater than, less than
symbol, waka standard stuff. They do
have their own resource.h that they
include though, and we can take a look
at that super quick. Looks like it just
defines a couple constants. So, nothing
that we really need to worry about. But
honestly, uh, all I care about to start
to kind of read through these things is
probably the main function. We know that
a lot of these functions might be
called, but let's go see how. So the w
main function looks like there's a try
statement and then a handful of the
output that we don't need to care about.
Uh then it creates a temporary root
based off of that function that's
defined up above that just looks like it
creates a temporary directory with an
SLT prefix. Um so creating a temporary
directory staging a payload for the
broken pipe payload.zip and then a
broken pipe bootstrap. PowerShell
script. Then it calls these extract
resource functions. So presumably the
payload and bootstrap files are going to
be uh actually included in as resources
for this compiled binary. Likely why
they had a whole lot of Visual Studio
stuff in the mix. So they just go ahead
and carve those out of the binary. And
then run bootstrap is what they
ultimately call for the end of this try
and return statement. So that's the
function that really does everything.
But what this does is get the Windows
directory stage PowerShell and then run
PowerShell with all the no profile
execution policy bypass file of the
PowerShell script and payload zip
uh and it runs it. Why why' you do that?
Why if you're just running PowerShell,
why wouldn't you just make it a
PowerShell payload? I'm going to turn
word raprap on so we can see a little
bit more of these. Um, looks like it
takes in the parameters. Looks like we
have an expected shot 256 hash of
probably the specific payload.zip that
is provided with the proof of concept
here. They specify that runtime route as
a directory and they literally extract
out from the zip archive more PowerShell
scripts. They determine what run they're
trying to do and then they use
PowerShell to start a command prompt.
Okay. So, what are the things that
they're taking from a prepare
interactive lab and now run interactive
lab? Those are presumably from the
payload. Yeah, in the zip file, right?
Obviously, that's a binary file. We have
to extract it. Let's get into that
folder. Get to the payload. Here is that
zip. Let me go ahead and extract that
here. Steam client service interactive
system lab for that version of Steam.
Okay. And there's much more stuff in
here. There's a package manifest.json.
That looks like a lot of unnecessary
stuff with a schema disposable lab only.
Okay. So, wallpaper engine is Steam. And
the VDF file is probably very pertinent
there. That has a SHA 256 hash. And then
the launcher behavior. This, I got to be
honest with you, is starting to smell a
little bit like Claude. Like the fact
that this is extremely tightened to,
okay, using only these exact specific
shot 256 hashes, this does not look like
a human written proof of concept. And
that's okay. That's totally fine.
Obviously, we saw the impact and there
are a handful of convenience functions
kind of staged here. A lot of
verification as to whether or not the
actual invoking user is in the
administrator path already. And then a
handful of assertions, staging and
dates. Expected pack schemes here. What
is all? Oh, there's a read me in here.
What? Steam client service interactive
system cmd lab. This package is only for
disposable offline Windows VM that you
own. It is a visual follow-up to the
already confirmed identity sentinel
pock. It is not the package submitted to
hacker 1.
Okay, so this was I think from
understanding the lore of the Reddit and
Twitter whining is that uh this was
submitted to Valve. Uh I don't think
they did anything with it. It went
through hacker one, but they go ahead
and explain how to use this specific
PowerShell script which is all bundled
up for preparing the interactive lab
with a lot of stuff. Did I already look
at that one? I'm I this run interactive
lab is ginormous and there's a lot of
staging just to be able to kind of
validate oh this exact specific
environment is exactly the thing that
this exact specific thing is supposed to
exactly specifically run lib. Oh
goodness there's even more here. So okay
ultimately this boils down if we try to
abstract out all of the fluff code.
Sorry, I'm intentionally running us into
this wall because I'm making the point,
I hope, explicitly clear that this is AI
generated, which is not a bad thing. I'm
not poo pooing on that. It just makes
this bigger than what an immediate human
brain is going to want to try to
understand. It looks like they have some
imported C stuff. They ensure there's no
game running. they eventually get to the
worthwhile function here that I am
understanding is the invokeh host IPC
request. So IPC being the inner process
communication right and being things
that the steam service is able to
actually retrieve or get some info from.
So obviously they open up these file
mappings for global Steam client service
mem file and mem lock. That is the IPC
gate that they try to retrieve out. And
I'm not going to pretend like I know
each and every part of everything that's
happening here. Forgive me. I do still
want to be able to walk you through it
and show you um a lot of this honestly
if just so we can find the needle in the
hay stack here as to what actually
matters. And we took a look through the
original readme, right, which kind of
had this explanation that an IPC
connection to the Steam client service
would allow us to then add our own
individual script to the allow list from
a genuine Valve sign or Valve data
format, but we're able to determine what
the installation directory or install
route or install dur. So our own
launcher, whatever executable that we
would provide as part of this payload
and proof of concept would then end up
being selected and executed and ran as
system. So it's the work with IPC that
actually matters here. This IPC
frames.ps1 PowerShell script are again
all just convenience functions to be
able to understand and I presume either
uh work with maybe from some reverse
engineering that they've done or how
they analyze a lot of the IPC format. Uh
I don't know if that's open or public,
but this is the PowerShell package that
allows easy convenience of working with
it. They also include in the assets here
a signed install script.vdf. So the
genuine Valve data format for the
wallpaper engine given that Steam app ID
431960.
But you can see that this is signed,
right? The KV signatures here say that
this is signed, but we're tricking it to
now have the install directory being
something that we specify, we create, we
stage in our own launcher.exe.
Now, I got to be real with you because
it's very clear to me that this proof of
concept is AI assisted and the source
code is machine generated. And there's
nothing wrong with that. I'm not trying
to poo poo on that. In all reality, I'm
doing the same thing. I got robots
running around doing vulnerability
research, analyzing malware, trying to
get some proof of concepts in place.
It's crazy what this technology with AI
can genuinely do. I know everyone has
different opinions, but I just do
realize that is the landscape of cyber
security right now. And I have to lean
into it because look, these robots can
use technology better than I can. So, if
their robot can crap this out, I got to
ask, can my robot do the same thing or
can it make some sense of all this soup?
Since we've now at least tried to
navigate around the original proof of
concept and we've made a little bit more
sense of it and have a finer
understanding. Now we could walk through
this simpler representation that hey,
we've also AI assisted. Nothing wrong
with that. We know in all reality this
could just be PowerShell. It can be
something stupid, dumb, copy and pasteed
in or like IRM pipe to IEX. For the
quick convenience, we could toggle
whatever local binary this thing wanted
to fire or like a command that thing
would actually execute. And we prepare
again just another separate directory.
So we have an attacker controlled home
where we put our own launcher.exe
which is realistically going to be
whatever we want. We find where the
steam executable is on disk. We make
sure that the payload that we want to
run or like cmd.exe. The binary that we
want to fire exists on disk. We go ahead
and make that working directory. Then we
join in our own launcher.exe and signed
valve data format. but then our own
tampered with our irregular VDF file.
And then we copy what is the payload
path, right? That cmd.exe into our
launcher. This B 64 string is honestly
just the um VDF for Wallpaper Engine.
Again, you can see this payload here.
Throw that in another tab here. You can
see it's the exact same that we already
saw, a signed VDF file for uh Wallpaper
engine. But note the gimmick here. This
launcher.exe exe is now going to become
our specific cmd.exe because installed
dur will now go to our own working
directory route. Comments go on to
explain that a little bit more. And then
our run.vdf or our own modified one is
the one that we prepare with some of the
quotes necessary that you saw as the
functions and some of the like C++ code
from the original proof of concept. But
now what we have for this ad type, so
some C that is being loaded in is all of
the boilerplate stuff that we need to be
able to interact with IPC. All the
things that you saw in that IPC.ps1
PowerShell script in the original
sample, that's just crammed into the
blob that we need because that's just
getting the wiring and capability to be
able to call those functions, work with
the methods, and interact with IPC for
Steam. then all it really needs because
this is not some memory corruption
vulnerability is just using the actual
functionality of IPC. We have functions
and methods here to add to the allow
list and then run and all that it does
is that th those two things. So, look,
however you want to interpret this, I
don't know if we were able to crank this
proof of concept down to just, I don't
know, a small simple PowerShell script,
maybe a little over a hundred lines. To
be honest, since we aren't bringing in
our own rogue C++ compiled launcher.exe,
and now we're just kind of bringing that
to a living off the land binary or any
other command that we want to run as
system. This thing probably won't even
trigger Defender right now. Let me uh
turn defender back on. Hello. Okay,
thanks. So, no tricks up my sleeve here.
I'm literally just going to copy our
entire PowerShell payload. This little
proof of concept that we just tightened
up because that's all we need. Now, you
can see Steam is still running, defender
is still on. Let's open up a terminal.
And remember, this is from a
lowprivilege user. I am just that John
account that I just created. I am not in
the administrators groups. We can take a
look at my privilege levels and I don't
got much. But let's go ahead and just
literally paste in all this crap to
trigger the IPC allow list and
invocation with Steam. I'm hands off
keyboard. Uh we could make that a script
honestly, but it'll pop system command
prompt a heck of a lot faster than the
other one was. And look, we're we're
we're anti we're anti- authority system,
right? Like okay, [laughter]
listen, I think we're in an interesting
phase change. Like I know people I don't
know scream and shout on LinkedIn
whatever about the AI era and the doom
and gloom of robot terminator Skynet
And not even to throw in like the
machine speed buzzword, but the fact of
the matter is the timeline is compressed
now. Research, vulnerability research,
malware analysis, a whole lot of aspects
of cyber security. Robots are running
around and god dang it, it is better at
doing my job than I am. And I'm totally
cool with that because I got plenty of
other stuff to do. I got millions of
other things to chase. whatever next
zero day vulnerability or proof of
concept or malware falls out of the sky.
I don't know. Sorry. I know not
everyone's going to agree with that
opinion and perspective, but you've seen
AI all throughout this proof of concept
and then we started to run with it
ourselves. I don't know. I don't know.
Sorry. I know not everyone will share
that perspective and of course you're
welcome to your own opinion, but we saw
AI throughout that proof of concept and
of course we got to run with our own
robots. But it's just fascinating to me
that almost to a to a certain extent the
finer details or all the idiosyncrasies
like all the tiny little complexities
for this attack chain or proof of
concept or exploit or whatever cyber
security thing is just kind of
abstracted away and you don't care
because the result is the only thing
that matters. like the impact, the
proven local privilege escalation or
remote code execution or just the fact
that this thing actually occurs, the
vulnerability, the risk, the exploits,
it becomes a super duper binary thing.
Is this vulnerable or not? I don't know.
Those are just things that I've been
thinking about uh in the wild times that
we're in. Um yeah, thanks so much for
watching everybody. Please do all those
YouTube algorithm things. Like, comment,
subscribe. Do give some love to our
sponsor down below and I'll see you in
the next