2026-07-25 –, Track 1
Every gaming peripheral that ships to your desk comes bundled with software running silently as NT AUTHORITY\SYSTEM. These OEM utilities are trusted, rarely audited, and almost never patched.
In this talk I walk through the discovery and exploitation of a local privilege escalation vulnerability in Cooler Master MasterPlus. A peripheral management suite installed on millions of Windows machines. The root cause is an unauthenticated named pipe exposed by MPService.exe (SYSTEM). Any standard local user can connect, send a single JSON payload, and execute arbitrary commands as SYSTEM with no admin rights, no user interaction, and no race condition required.
I'll cover the full methodology: service enumeration, pipe discovery, Ghidra static analysis, dynamic confirmation, and a working proof-of-concept.
OEM peripheral software ships trusted on millions of Windows machines, runs as SYSTEM, and almost never receives a security review. Inspired by Leon Jacobs' DEF CON 33 research, this talk applies the same methodology to a major peripheral manufacturer's management suite.
Methodology:
Systematic enumeration of SYSTEM services, IPC surface discovery, access control analysis, and binary reverse engineering. I'll cover the tooling and decision points that led from initial enumeration to a confirmed vulnerability.
Root Cause Analysis:
Static analysis identifies a privileged IPC handler that accepts unauthenticated connections from any local user and processes attacker-controlled input without validation. I'll walk through the decompiled code showing exactly where the trust boundary fails and why the impact is full SYSTEM code execution.
Demo:
Proof-of-concept demonstrated live: standard user to NT AUTHORITY\SYSTEM in a single step. No admin rights, no user interaction, no race condition.
Remediation & Disclosure:
Vendor disclosure process including what to expect when a vendor has no dedicated PSIRT.
Takeaways & Q&A:
Key Takeaways
- A replicable methodology for auditing OEM/bloatware SYSTEM services
- How Windows IPC access controls are commonly misconfigured
- Navigating coordinated disclosure with vendors that lack a PSIRT
Tyron Kemp is a cybersecurity professional with with a background spanning network engineering, penetration testing, and deception technology. He is perhaps best known for his Black Hat USA 2020 briefing, Routopsy: Modern Routing Protocol Vulnerability Analysis and Exploitation, co-presented with Szymon Ziolkowski at SensePost, where he exposed how misconfigured dynamic routing and first-hop redundancy protocols can be weaponised for person-in-the-middle attacks, releasing an open-source toolkit alongside the research.
In recent years, Tyron has worked where offensive tradecraft, detection engineering, and deception technologies overlap, helping organisations understand how attackers operate and how to reduce risk in ways that matter.
In his BSides Joburg 2026 talk, Pipe Dreams, he turns his attention to the endpoint by walking through how he escalated privileges to SYSTEM via Cooler Master's MasterPlus software, because sometimes the most dangerous vulnerabilities are hiding in the software you least expect.