Windows Plug and Play Auto-Install Abused for Local and Remote SYSTEM Elevation

Overview of the Vulnerability

A fundamental design feature in Microsoft Windows—the Plug and Play (PnP) driver auto-installation mechanism—can be weaponized by low-privilege users to gain full NT AUTHORITY\SYSTEM code execution. Detailed by security researchers Alejandro Hernando and Borja Martinez at DEF CON 34 in their presentation “Plug And Pwn: Weaponizing Windows PnP Auto-Install”, the attack technique exploits how Windows automatically identifies attached hardware, retrieves signed driver packages, and executes privileged installation components without requiring administrative approval.

The core underlying issue resides at the intersection of Windows device management trust boundaries and weak security practices in vendor-supplied co-installers. When a USB peripheral is attached to a machine, the Windows PnP subsystem queries its Hardware IDs and Compatible IDs, subsequently matching them against driver packages to automatically configure the device. Because these installer components and background services run with elevated system privileges to perform system-level hardware setup, flaws within third-party vendor packages—such as insecure HTTP requests, path traversal, and DLL search-order hijacking—can be chained by a local or remote user to compromise the underlying operating system. The researchers demonstrated working privilege escalation chains on fully updated Windows 11 systems.

Local and Remote Exploit Mechanics

The researchers developed two distinct exploitation avenues depending on the access vector: a physical hardware emulation chain and a remote synthetic USB chain conducted over Remote Desktop Protocol (RDP).

The Physical Emulation Chain

To execute the attack locally, an attacker presents emulated USB device signatures to the target operating system using custom hardware tooling. The physical exploit sequence follows a multi-stage approach:

1. Initial Service Deployment: The attacker emulates a Sierra Wireless USB device. Windows PnP recognizes the hardware ID and automatically installs the corresponding vendor software, dropping a background service named SwiService.exe that runs as SYSTEM. This service exposes an unauthenticated control primitive (SetDNS).
2. Traffic Redirection: The attacker invokes the SetDNS primitive to alter local DNS resolution settings on the victim machine.
3. Arbitrary File Write via Path Traversal: Next, the attacker emulates a Sony FeliCa card reader. The associated Sony co-installer automatically executes, fetching configuration files over unencrypted, plaintext HTTP. Because local DNS resolution is controlled by the attacker, the HTTP request hits an attacker-controlled server. The co-installer derives local destination filenames directly from the incoming URL path without adequate sanitization; a path-traversal vulnerability in this routine allows the attacker to drop an arbitrary malicious DLL directly into C:\Windows\System32\.
4. Code Execution: The attacker re-triggers or reconnects the Sierra Wireless device, causing SwiService.exe to load the newly planted DLL from System32 and execute attacker payload code under the SYSTEM account context.

The Remote RDP Variant

The technique does not strictly require physical USB access. By leveraging Remote Desktop Services with Plug and Play or RemoteFX low-level USB redirection enabled, an authenticated remote user with low privileges can perform the attack over a network session:

1. Synthetic Traffic Injection: Using a custom Python client, the attacker streams forged USB protocol traffic through the RDP redirection channel.
2. Phantom Peripheral Registration: The client presents a phantom Intel RealSense peripheral identity to the target Windows machine, forcing the OS to trigger its standard redirected device-installation workflow.
3. DLL Search-Order Hijacking: The resulting Intel RealSense software installer creates a user-writable installation directory and attempts to load system libraries without absolute paths. The attacker drops a malicious CRYPTBASE.dll into the user-writable installation directory, triggering a classic DLL search-order hijack when the high-privilege setup routine runs, yielding immediate SYSTEM code execution.

Environmental Impact and Blast Radius

The realistic blast radius of this attack class spans enterprise workstations, shared multi-session environments, and virtual desktop infrastructure (VDI).

On physical enterprise endpoints, any user who can connect a programmable USB microcontroller (such as a Rubber Ducky, Flipper Zero, or custom microcontroller) can elevate from a restricted local user to full host takeover, completely bypassing standard Endpoint Detection and Response (EDR) agents that trust signed Microsoft-approved driver installation flows.

In Remote Desktop and VDI environments, the blast radius expands to remote network attackers who hold low-privilege domain credentials. If an enterprise remote desktop server has enabled low-level USB or PnP redirection to allow end users to pass local peripherals through to their virtual sessions, any low-privilege domain user can leverage synthetic USB traffic to compromise the host underlying the RDP session.

However, the remote vector is configuration-dependent. Microsoft Remote Desktop Services explicitly disables Plug and Play and RemoteFX USB redirection by default. An enterprise is only exposed to the remote RDP vector if administrators actively enabled device redirection policies without restricting which hardware setup classes can be processed.

Remediation and Mitigation Strategies

Because this attack vector abuses legitimate OS hardware configuration mechanics combined with flaws in third-party vendor installers, mitigation requires administrative policy enforcement and strict peripheral controls.

• Disable RDP Device Redirection: Ensure that RemoteFX USB redirection and Plug and Play device redirection remain disabled across enterprise Remote Desktop Session Hosts and VDI templates. Verify that Group Policy setting Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection > Do not allow Supported Plug and Play device redirection is set to Enabled.
• Enforce Device Installation Restrictions: Implement strict Windows Device Installation Policies via Group Policy under Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions. Organizations should configure policy rules to block the installation of devices matching specific Hardware IDs, Compatible IDs, or Device Setup Classes that are not explicitly authorized for business use.
• Audit Third-Party Driver Repositories: Enterprise systems administrators should review driver staging stores and third-party software deployment packages for outdated co-installers or drivers associated with Sierra Wireless, Sony FeliCa, and Intel RealSense utilities if those hardware components are not actively deployed in the enterprise.