An unprivileged user can turn Windows Plug and Play auto-install into SYSTEM code execution on a fully updated Windows 11 machine, security researchers Alejandro Hernando and Borja Martinez report in research prepared for DEF CON 34.
How the "Plug And Pwn" technique works
In research titled "Plug And Pwn: Weaponizing Windows PnP Auto-Install," Hernando and Martinez built tooling to emulate arbitrary USB devices and drove Windows' legitimate device-installation path to run privileged components. The researchers say Windows uses hardware and compatible IDs reported by a device to locate a matching signed driver package, a behavior documented in Microsoft's driver documentation. Under the conditions they describe, an unprivileged, authenticated user can cause that installation path to execute code as SYSTEM on a fully updated Windows 11 machine.
The physical-emulation chain: Sierra Wireless and Sony FeliCa
The researchers describe a specific physical-emulation chain that begins by emulating a Sierra Wireless device so Windows installs SwiService.exe, a SYSTEM service that exposes a SetDNS primitive. Using that primitive, they redirect DNS and then emulate a Sony FeliCa reader. According to the researchers, the FeliCa co‑installer retrieves configuration files over plaintext HTTP and derives local filenames from URL paths. They say a path‑traversal flaw in that step lets them place a DLL into System32; reconnecting the Sierra device then loads the planted DLL and yields SYSTEM.
The demonstration cited by the researchers ran on a fully updated Windows 11 system; the researchers caution that the result should not be generalized to an untested range of Windows versions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRemote Desktop variant: forged USB identities and Intel RealSense
The same Plug and Play installation path can be triggered without any physical hardware when supported Plug and Play or low‑level USB redirection is enabled over Remote Desktop, the researchers report. Hernando and Martinez built a Python client that forges USB identities and presents a phantom Intel RealSense device; Windows follows the redirected device-installation path and installs the RealSense software.
The researchers say that resulting RealSense software can be abused through a CRYPTBASE.dll search‑order hijack from a user‑writable installation directory, providing an authenticated low‑privilege user SYSTEM code execution. Microsoft separately documents that redirected low‑level USB peripherals use the same driver‑installation process as a physical Windows computer.
Microsoft configuration, default behavior, and administrative controls
Microsoft told the researchers that the remote path is configuration‑dependent and not a default Windows exposure. Remote Desktop Services does not allow supported Plug and Play and RemoteFX USB redirection by default, and Microsoft's USB‑redirection guidance requires Plug and Play redirection to be enabled before low‑level USB forwarding works. Administrators that do not need the feature can leave it disabled.
Microsoft also provides device‑installation restrictions that can allow or block devices by hardware or compatible ID, device‑instance ID, and setup class. On a Remote Desktop server those policies can also affect redirected devices. The physical attack chain carries its own precondition: an attacker must be able to present an emulated USB device to the target machine.
What this means for technologists, administrators, and end users
- Technologists and security teams: the research highlights how a legitimate, privileged installation path can be weaponized when signed third‑party packages expose weak co‑installer behavior (for example, fetching files over plaintext HTTP or deriving local filenames from URL paths). Teams will likely focus on auditing driver packages and co‑installer behavior where possible.
- Administrators and procurement leaders: Microsoft’s configuration guidance is central here — Plug and Play redirection and low‑level USB forwarding must be enabled for the remote path to work, and device‑installation restrictions can block specific hardware or compatible IDs. Administrators that do not require remote USB forwarding can leave the feature disabled.
- End users: the physical attack requires presenting an emulated USB device, and the remote attack depends on server configuration. Those constraints limit exposure in many environments, but authenticated low‑privilege accounts interacting with systems that allow redirection or accept certain vendor drivers could be at risk.
The research demonstrates abuse of a legitimate privileged installation path combined with weaknesses in signed third‑party packages. The vendor‑specific Sierra, Sony, and Intel exploit mechanics remain researcher findings and should stay attributed unless matching vendor material independently confirms them.
