KillaBoi/BrokenPipe
Steam Client Service Local Privilege Escalation Vulnerability
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
This is the single-script version. The original compiled C++ PoC is on the legacy branch. Thanks to John Hammond for the suggestion, subscribe to him! PoC video: YouTube John Hammond's breakdown: YouTube Greetz to @MSNIGHTMARE2000 for the inspo - please give him a job and email him! Shoutout to Tookie, Hazetick, belogen and bet3rd for being the ultimate homies. I'm still waiting for our gaming session lusilly •´• BrokenPipe demonstrates a local privilege escalation from a standard Windows account to NT AUTHORITY\SYSTEM through the Steam Client Service. The proof launches a SYSTEM command prompt without requesting administrator credentials or displaying a UAC prompt. The Steam Client Service (steamservice.exe), which always runs as SYSTEM, accepts a caller-controlled installation root that is not covered by the signature of a genuine Valve-signed install-script VDF. BrokenPipe uses this signature-coverage gap to make the privileged service execute the included launcher from a relocated path as…
Read the full README ↗ · Preview checked 2026-10-30T15:44:55.248Z
Inside the original README — Document outline
- BrokenPipe - Steam Client Service LPE Vulnerability
- What is BrokenPipe?
- What the screenshot above proves
- Technical summary
- Requirements
- Usage
- Source layout
- FAQ
- Legacy
- Disclaimer
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Documentation belongs to its respective authors. Reported project/model license: Apache-2.0. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Steam Client Service Local Privilege Escalation Vulnerability
Repository facts
- Owner
- KillaBoi
- Primary language
- PowerShell
- Stars
- 211
- Forks
- 51
- Open issues + pull requests
- 0
- License
- Apache-2.0
- Archived
- No
- Default branch
- main
- Created
- 2026-09-14T20:10:03.000Z
- Last push
- 2026-09-18T00:52:59.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-09-21T06:41:42.808Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.