Pipe Dreams: Escalating to SYSTEM via Cooler Master MasterPlus

No ratings

Presented at BSides Joburg 2026 by

Tyron Kemp

Every gaming peripheral that ships to your desk comes bundled with software running silently as NT AUTHORITY\SYSTEM. These OEM utilities are trusted, rarely audited, and almost never patched. In this talk I walk through the discovery and exploitation of a local privilege escalation vulnerability in Cooler Master MasterPlus. A peripheral management suite installed on millions of Windows machines. The root cause is an unauthenticated named pipe exposed by MPService.exe (SYSTEM). Any standard local user can connect, send a single JSON payload, and execute arbitrary commands as SYSTEM with no admin rights, no user interaction, and no race condition required. I'll cover the full methodology: service enumeration, pipe discovery, Ghidra static analysis, dynamic confirmation, and a working proof-of-concept.