A recent study has exposed how Windows Plug and Play can be manipulated to achieve SYSTEM-level access on Windows 11 machines. Researchers Alejandro Hernando and Borja Martinez demonstrated this at DEF CON 34 with a technique they call 'Plug And Pwn.' By emulating USB devices, they showed how an attacker could exploit the Plug and Play auto-installation feature to execute privileged software components. This technique can also be applied remotely over Remote Desktop when specific USB redirection settings are enabled, although Microsoft clarifies that these settings are not enabled by default.
The process begins with an attacker emulating a Sierra Wireless device, prompting Windows to install a SYSTEM service called SwiService.exe. This service facilitates DNS redirection, which is then used to emulate a Sony FeliCa reader. The reader's co-installer retrieves configuration files via plaintext HTTP, where a path-traversal vulnerability can allow harmful files to be placed in the System32 directory. By reconnecting the Sierra device, the malicious DLL is loaded, granting the attacker SYSTEM access.
For the remote variant, the researchers used a Python client to mimic a USB device over RDP, specifically targeting an Intel RealSense device. This method exploits a CRYPTBASE.dll search-order hijack in a user-writable directory, granting SYSTEM access to a low-privilege user. It's important to note that this remote attack depends on specific configurations that are not default in Windows.
Microsoft advises administrators who do not require USB redirection to keep it disabled and offers guidelines to restrict device installations based on various identifiers. This research highlights vulnerabilities in legitimate privileged installation paths and emphasizes the need for careful management of device installation policies.