Turns out all you need to gain admin privileges on Windows 10 is to plug in a Razer mouse

guest · Aug 22, 2021

Turns out all you need to gain admin privileges on Windows 10 is to plug in a Razer mouse
August 22, 2021
https://mspoweruser.com/turns-out-a...es-on-windows-10-is-to-plug-in-a-razer-mouse/

Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift+Right click
Tried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz
— jonhat (@j0nh4t) August 21, 2021

The issue is that Windows Update downloads and executes RazerInstaller as system, and that the Installer offers users the opportunity to open an Explorer window to choose where to install the drivers.
From there it only takes a shift-right-click to open a Powershell terminal with system privileges, and the hacker can basically do whatever they want.
Click to expand...

Attackers do not even need a real Razer mouse, as the USB ID can be easily spoofed.

jonhat says he attempted to contact Razer but was unsuccessful, and has therefore released the vulnerability. We assume Microsoft will move somewhat faster and remove the driver from Windows Update soon, though there is no guarantee as it would leave Razer hardware users without an easy way to access the driver.
Click to expand...

guest · Aug 22, 2021

Razer bug lets you become a Windows 10 admin by plugging in a mouse
August 22, 2021
https://www.bleepingcomputer.com/ne...me-a-windows-10-admin-by-plugging-in-a-mouse/

A Razer Synapse zero-day vulnerability has been disclosed on Twitter, allowing you to gain Windows admin privileges simply by plugging in a Razer mouse or keyboard.

When plugging in a Razer device into Windows 10 or Windows 11, the operating system will automatically download and begin installing the Razer Synapse software on the computer. Razer Synapse is software that allows users to configure their hardware devices, set up macros, or map buttons.
Razer claims that that their Razer Synapse software is used by over 100 million users worldwide.
Click to expand...

Getting SYSTEM privileges by plugging in a mouse
As BleepingComputer has a Razer mouse available, we decided to test out the vulnerability and have confirmed that it took us about two minutes to gain SYSTEM privileges in Windows 10 after plugging in our mouse.

It should be noted that this is a local privilege escalation (LPE) vulnerability, which means that you need to have a Razer devices and physical access to a computer. With that said, the bug is so easy to exploit as you just need to spend $20 on Amazon for Razer mouse and plug it into Windows 10 to become an admin.
Click to expand...

Razer to fix the vulnerability
After this zero-day vulnerability gained wide attention on Twitter, Razer has contacted the security researcher to let them know that they will be issuing a fix.

I would like to update that I have been reached out by @Razer and ensured that their security team is working on a fix ASAP.
Their manner of communication has been professional and I have even been offered a bounty even though publicly disclosing this issue.
— jonhat (@j0nh4t) August 22, 2021
Razer also told the researcher that he would be receiving a bug bounty reward even though the vulnerability was publicly disclosed.
Click to expand...

zapjb · Aug 22, 2021

Ha ha W10.

Log in or Sign up

Turns out all you need to gain admin privileges on Windows 10 is to plug in a Razer mouse

guest Guest

guest Guest

zapjb Registered Member

Log in or Sign up

Turns out all you need to gain admin privileges on Windows 10 is to plug in a Razer mouse

guest Guest

guest Guest

zapjb Registered Member

Useful Searches