Plug and Pwn: USB Driver Auto-Install Becomes a SYSTEM Takeover on Windows 11

The Plug and Play (PnP) mechanism, which in Windows is responsible for automatically matching and installing drivers, has turned out to be a convenient foothold for privilege escalation. Researchers Alejandro Hernando and Borja Martinez, in their work “Plug And Pwn: Weaponizing Windows PnP Auto-Install,” prepared for DEF CON 34, demonstrated how an unprivileged user can push the built-in driver installation path all the way to code execution with SYSTEM privileges on a fully updated Windows 11.

The idea is simple: Windows obtains a device's hardware and compatible identifiers and uses them to search for a matching driver package. The authors wrote a tool that emulates arbitrary USB devices and made the system install perfectly legitimate, signed vendor software — and it is the weaknesses already present in those packages that open the door to the attack.

The physical chain

First, a Sierra Wireless device is emulated, which causes Windows to install the SwiService.exe service that runs as SYSTEM and provides a SetDNS primitive. It is used to spoof DNS. Then a Sony FeliCa reader is emulated: its co-installer downloads a configuration over plain HTTP and builds local file names from URL paths. A directory traversal (path traversal) vulnerability allows an attacker to place their own DLL directly into System32; reconnecting the Sierra device loads the planted library — and the attacker obtains SYSTEM.

The remote variant over RDP

The physical device can be replaced with synthetic USB traffic over Remote Desktop. The researchers' Python client forges a USB identity and impersonates a phantom Intel RealSense device, forcing Windows through the same installation path. The installed RealSense software turns out to be vulnerable to search-order hijacking of CRYPTBASE.dll from a directory writable by the user, which again yields SYSTEM — this time to an authenticated, low-privileged user.

An important caveat: the remote scenario depends on configuration, not on Windows' default settings. Microsoft stresses that Remote Desktop Services do not allow PnP and low-level USB device redirection (RemoteFX) by default — Plug and Play redirection must first be enabled. For administrators who do not need this feature, the company advises simply leaving it turned off, as well as using policies that restrict device installation by identifiers and classes. The physical chain also has a prerequisite: the attacker must be able to connect the emulated device to the target.

In essence, the work demonstrates not a single hole but the abuse of a legitimate privileged installation mechanism in combination with flaws in signed third-party packages. The specific details regarding Sierra, Sony, and Intel remain the researchers' findings and should not be generalized to untested versions of Windows.

Source: The Hacker News