Windows Plug and Play may be leveraged to fetch signed vendor software for an emulated USB device and run the installation component at elevated privileges. It has been used in combination with gaining SYSTEM level access on a fully updated Windows 11 machine.
Security researchers Alejandro Hernando and Borja Martinez presented the Windows Plug and Play privilege escalation technique at DEF CON 34. They built tooling to emulate arbitrary USB devices and demonstrated that an unprivileged user can turn the PnP installation path into SYSTEM code execution under the right conditions.
Let me walk through the Windows Plug and Play privilege escalation technique, how it works, and what defenders need to know.
How Plug and Play Auto-Installation Works
The Windows Plug and Play privilege escalation technique abuses a legitimate Windows feature. When you plug in a new device, Windows receives hardware and compatible IDs for that device and uses them to find a matching driver package. Microsoft's own driver documentation describes this selection step.
This process has been specifically developed to enable device configuration without hassles. However, using the Windows Plug and Play privilege escalation technique, it is evident how such a convenient feature can become a security threat.
The Physical Attack Chain
The Windows Plug and Play privilege escalation technique starts by emulating a Sierra Wireless device. When Windows detects this device, it installs SwiService.exe, a SYSTEM service that exposes a SetDNS primitive.
The researchers use this primitive to redirect DNS. Then they emulate a Sony FeliCa reader. The FeliCa co-installer retrieves configuration files over plaintext HTTP and derives local filenames from URL paths.
The co-installer contains a path-traversal flaw that lets the researchers place a DLL in System32. Reconnecting the Sierra device then loads the planted DLL and yields SYSTEM access.
The Windows Plug and Play privilege escalation demonstration used a fully updated Windows 11 system. The result should not be generalized to untested Windows versions.
The Remote Desktop Variant
The Windows Plug and Play privilege escalation technique also works over Remote Desktop. The researchers built a Python client that forges a USB identity and presents a phantom Intel RealSense device over RDP. This causes Windows to follow the redirected device-installation path.
The resulting RealSense software can be abused through a CRYPTBASE.dll search-order hijack from a user-writable installation directory. The remote variant gives the authenticated low-privilege user SYSTEM code execution.
Microsoft separately documents that redirected low-level USB peripherals use the same driver-installation process as a physical Windows computer.
Configuration-Dependent Exposure
The remote path in the Windows Plug and Play privilege escalation technique is configuration-dependent. It is not a default Windows exposure. Microsoft says Remote Desktop Services does not allow supported Plug and Play and RemoteFX USB redirection by default.
USB-redirection guidance requires Plug and Play redirection to be enabled before low-level USB forwarding works. Administrators who do not need the feature can leave it disabled.
Microsoft also provides device-installation restrictions that can block devices by hardware or compatible ID, device-instance ID, and setup class. On a Remote Desktop server, those policies can also affect redirected devices.
Physical Access Required
The physical chain in the Windows Plug and Play privilege escalation technique requires the attacker to present an emulated USB device to the target machine. This means the attack is not remotely exploitable in a default configuration.
But then, in environments where users can connect USB devices, the risk exists. Organizations should think about limiting the use of USB devices on sensitive systems.
Abuse of Signed Third-Party Software
The Windows Plug and Play privilege escalation technique demonstrates abuse of a legitimate privileged installation path combined with weaknesses in signed third-party packages.
The researchers identified issues in software from Sierra Wireless, Sony, and Intel. The vendor-specific exploit mechanics remain researcher findings and should be attributed unless vendor material independently confirms them.
The vulnerabilities are not in Windows itself. They are in third-party driver packages that Windows trusts because they are signed. Windows cannot easily distinguish between legitimate and malicious driver behavior once the driver is signed.
Defensive Measures
The Windows Plug and Play privilege escalation technique has certain implications from a defensive standpoint.
- Organizations must limit access to USB connections on critical systems. The physical chain requires physical access or the ability to present an emulated device.
- Remote Desktop administrators should review USB redirection policies. The remote variant requires enabled low-level USB forwarding. If you do not need this feature, leave it disabled.
- Organizations can use device-installation restrictions to block devices by hardware or compatible ID. Microsoft provides Group Policy settings for this purpose.
- Consider restricting which users can install devices on sensitive systems. The Windows Plug and Play privilege escalation technique relies on the auto-installation process.
Microsoft's Position
The Windows Plug and Play privilege escalation technique was presented at DEF CON 34. The research demonstrates abuse of legitimate features combined with weaknesses in third-party packages.
Microsoft has not issued a specific patch because the vulnerabilities are in third-party driver packages, not in Windows itself. The mitigations are configuration-based.
Wrapping It Up
The Windows Plug and Play privilege escalation technique abuses a legitimate Windows feature to achieve SYSTEM access. Researchers demonstrated the attack on a fully updated Windows 11 system.
The physical chain emulates a Sierra Wireless device, redirects DNS, and uses a Sony FeliCa co-installer with a path-traversal flaw to plant a DLL. The remote variant uses synthetic USB traffic over RDP.
The technique relies on weaknesses in signed third-party driver packages. Microsoft provides device-installation restrictions as a mitigation.USB redirection policies must be checked by administrators to ensure device installation is restricted whenever possible.
Windows Plug and Play is just one example of how even auto-install features can be exploited for privilege escalation.
FAQ Section
What is the Windows Plug and Play privilege escalation technique?
It is a technique where an attacker abuses Windows Plug and Play auto-installation to achieve SYSTEM access. The attack uses emulated USB devices and weaknesses in signed third-party driver packages.
How does the physical attack work?
The attacker emulates a Sierra Wireless device, redirects DNS, emulates a Sony FeliCa reader, uses a path-traversal flaw to plant a DLL, and then loads the DLL to achieve SYSTEM access.
Does the attack work over Remote Desktop?
Yes. The researchers developed a Python client that forges a USB identity over RDP. The remote variant requires enabled low-level USB redirection, which is not a default Windows configuration.
What should administrators do?
Restrict USB device access, review Remote Desktop USB redirection policies, and use device-installation restrictions to block devices by hardware or compatible ID.
Is this a Windows vulnerability?
No. The vulnerabilities are in third-party driver packages from Sierra Wireless, Sony, and Intel. Windows trusts these packages because they are signed. Microsoft provides configuration-based mitigations.
