Razer System Shell from Bash Bunny - no longer working

[EthicalMadHatter]

Microsoft must have patched it. Using Razor's VID and any number of PIDs no longer cause software download and installation on Windows.

Instead script opens Recycle Bin (ironic).
Test with BashBunny 1.7_332 (latest available from the store as of writing)
Windows 11

[bad-antics]

This is confirmed — Microsoft patched the Razer Synapse auto-install vulnerability in Windows 11. The original exploit (CVE-2021-44226) relied on Windows automatically downloading and running the Razer Synapse installer when a Razer HID device was plugged in, which gave you a SYSTEM-level PowerShell through the installer's "Open with PowerShell" context menu.

What changed:

1. Windows 11 no longer auto-downloads driver software from Windows Update for unknown USB HID devices in the same way
2. Razer patched Synapse to no longer expose the PowerShell escalation path
3. Microsoft's Autopilot/driver framework was updated to prevent the class of attack entirely

Why it opens Recycle Bin:

When spoofing the Razer VID/PID, Windows 11 recognizes it as a Razer device but instead of triggering the old Synapse installer flow, it falls through to default HID handling. The Recycle Bin opening is likely the system interpreting one of the HID reports as a keyboard shortcut or shell command.

Alternatives:

This specific LPE vector is dead on patched Windows 11. Similar auto-install LPE vectors for other vendors (SteelSeries, etc.) have also been patched.

For Bash Bunny privilege escalation on modern Windows 11, you'd need to look at other techniques like:

• UAC bypass methods (fodhelper, eventvwr, etc.)
• DLL sideloading via trusted applications
• Token manipulation if you already have user-level access