Video Demonstrates Steam Local Privilege Escalation on Windows

Summary

John Hammond demonstrates a proof of concept that elevates a low-privilege Windows user to SYSTEM through Steam's client service. He traces the IPC and signed VDF mechanism and discusses the PoC's apparent AI-assisted development.

Key points

• The demonstration shows a low-privilege user on Windows 11 obtaining NT AUTHORITY\SYSTEM; the exploit requires existing local access, not remote access.
• The PoC is described as targeting Steam version 10.96.30.42. Hammond says he believes that was the latest version at the time, based on his notes.
• Hammond explains that the exploit uses Steam client service IPC to add a launcher to an allowlist and manipulate a signed Valve data format so a chosen executable runs as SYSTEM.
• Windows Defender stopped the compiled brokenpipe.exe during the demonstration. Hammond temporarily disabled it for that test, then later showed a simplified PowerShell PoC succeeding with Defender back on.
• The PoC's README says its lab package is for a disposable offline Windows VM owned by the user and is not the package submitted to HackerOne.
• Hammond says the PoC appears AI-generated or AI-assisted, and discusses how AI may accelerate vulnerability research and proof-of-concept development.

MITRE ATT&CK