# Arbitrary file creation with semi-controlled content (leads to DoS, EoP and others) at Steam Windows Client

Steam Client Service writes a log file to a registry-controlled InstallPath, letting a non-admin redirect creation via NTFS symlinks to arbitrary SYSTEM-writable paths.

- Payout: $1,250
- Severity: medium
- Program: Valve
- Credited: xi-tauw
- Disclosed: 2019-09-26
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/682774
- Library page: https://bugbountylibrary.com/r/h1%3A682774
- Tags: domain:desktop impact:dos impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:chained vuln:misconfiguration vuln:path-traversal vuln:privilege-escalation

**Target:** SteamService.exe / Steam Client Service log file creation
**Root cause:** The service builds the log path from the user-writable HKLM\Software\wow6432node\valve\steam InstallPath registry value and writes service_log.txt there without validating the resolved path or preventing reparse-point redirection.
**Steps:**
1. Copy Steam.exe and steamservice.dll to `C:\test`, create empty `C:\test\logs`.
2. Set registry `HKLM\Software\wow6432node\valve\steam\InstallPath` to `C:\test\1\..` (Users have Full control).
3. Start Steam Client Service; observe `C:\test\logs\service_log.txt` created with attacker-influenced content.
4. Inject CRLF into InstallPath via regedit binary modify to control log lines.
5. Create reparse point `C:\test\logs` -> `\RPC Control\`, then `CreateSymlink.exe C:\test\logs\service_log.txt <target>`.
6. Restart service; it creates/appends to `<target>` as NT AUTHORITY\SYSTEM with controlled lines.
**How found:** Noticed the service logs to a path derived from a user-writable registry key, then observed Windows auto-simplifies `\..\` paths and that CRLF could be injected into the registry value; combined with Project Zero symlink-testing tools to redirect the write.
**Exploitation:** Non-admin sets InstallPath and uses a mount-point + object-directory symlink combo (no admin needed) to redirect the SYSTEM service's log write to any target path, appending attacker-controlled lines. Targets include SAM/SECURITY (DoS), hosts file (DNS redirect), and Startup folder .bat (horizontal EoP).
**Escalation:** Chains file-write primitive to DoS (corrupt SAM), network redirection (hosts), horizontal EoP via Startup .bat executed at other users' logon, and potential vertical EoP by appending to privileged .bat scripts (NVIDIA/VMware/GPO).
**Insight:** When a privileged service derives a file path from a user-writable registry/config value, test whether Windows path normalization (`\..\`) plus NTFS reparse-point/object-directory symlinks (creatable without admin) let you redirect the write to arbitrary SYSTEM-writable targets.