KillaBoi/BrokenPipe

What it is

BrokenPipe is a single-file PowerShell PoC (BrokenPipe-PowerShell.ps1) for the standard-user-to-SYSTEM privilege escalation in the Steam Client Service, previously described as C++ in a legacy branch. No build step: the Valve-signed VDF is embedded as base64 and the IPC client is inline C#.

How it works

flowchart TD
    A[Standard user, no admin] --> B[IPC connect to Steam Client Service]
    B --> C[AddInstallScriptToWhiteList:<br/>genuine signed VDF + attacker install root]
    C --> D[RunInstallScript]
    D --> E[Service launches relocated<br/>launcher.exe as SYSTEM]

The service's signature check on the install-script VDF doesn't cover the caller-supplied installation root, so a genuine Valve-signed VDF can be whitelisted against an attacker-chosen path. The script does not forge or bypass the signature itself.

Preconditions / Affected

• Windows 10 or 11 x64, Windows PowerShell 5.1 (built-in)
• Steam installed and the Steam Client Service running; Steam can be idle at the unauthenticated login screen, no account login or game launch needed
• Confirmed on Steam 10.96.30.42

What to do

Run unelevated from the project directory:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\BrokenPipe-PowerShell.ps1

By default this relocates and launches C:\Windows\System32\cmd.exe as SYSTEM (verify in Task Manager/Process Explorer). To run a custom payload instead:

.\BrokenPipe-PowerShell.ps1 -PayloadPath "C:\path\to\payload.exe" -PayloadArguments "your args"

If Steam isn't running, the script starts it silently first. The repo frames use for authorized research/defensive validation only, on systems you own or have permission to test.

Caveats

The page itself provides no patch, mitigation, or detection guidance beyond the repro steps — the author states Valve has not fixed it since the March report and offers no workaround for defenders.