Plug and Pwn: SYSTEM Access via Windows Plug and Play Abuse

Overview of Plug and Pwn Attacks

Security researchers Alejandro Hernando and Borja Martínez have unveiled “Plug and Pwn,” a novel set of attack techniques that exploit the fundamental behavior of Windows’ Plug and Play feature to achieve NT AUTHORITY\SYSTEM privileges. Presented at DEF CON 34, these attacks capitalize on how Windows automatically identifies newly connected hardware, locates corresponding driver packages, and installs vendor software with the highest system privileges. The core issue, as highlighted by BleepingComputer, lies in the privileged installation path that allows vendor-supplied components, including co-installers and services, to execute as SYSTEM without a User Account Control (UAC) prompt.

Technical Details: How Plug and Pwn Exploits Windows Plug and Play

The Plug and Pwn methodology leverages software-defined USB device emulation to trick Windows into installing specific vendor software packages. By emulating various USB devices, attackers can force the operating system to install signed but vulnerable vendor packages, which can then be exploited to gain SYSTEM privileges. This approach demonstrates a significant risk for environments where physical or even remote access to Windows systems is possible.

USB Device Emulation and Privileged Installation

The researchers employed a combination of FaceDancer – a software framework for emulating USB devices – with Cynthion and GreatFET hardware, connected via a small Linux computer. This setup allows for the precise definition of USB descriptors, interfaces, device classes, and endpoints, making the emulated hardware appear as specific, legitimate USB devices to Windows. Once recognized, Windows proceeds to locate and install associated vendor driver packages. Some advanced attack chains require the emulated device to disconnect and then re-enumerate as a different device identity, enabling the loading of specific vendor packages over inbox drivers by presenting as a composite device.

Zero-Click Physical Attack Chain

One particularly concerning demonstration involves a zero-click physical attack targeting a fully updated Windows 11 computer with no user logged in. This chain, which takes approximately five minutes to execute, proceeds as follows:

1. Sierra Wireless Impersonation: The attacker first impersonates a Sierra Wireless device. This prompts Windows to install associated software.
2. DNS Manipulation: The Sierra Wireless software contains an exploitable component that allows the attacker to change the system’s DNS settings.
3. Sony FeliCa Impersonation: Next, the attacker impersonates a Sony FeliCa device. Windows then installs additional Sony software.
4. Unencrypted Download and Exploitation: The Sony software is designed to download files over an unencrypted connection. By controlling the system’s DNS (via the previous step), the attacker redirects these downloads to a malicious server.
5. Malicious File Placement: An identified flaw in the Sony software allows the attacker to place a malicious file on the system with SYSTEM privileges.
6. SYSTEM Reverse Shell: Finally, the attacker re-impersonates the Sierra device, causing Windows to load the newly placed malicious file. This grants the attacker a reverse shell with full SYSTEM privileges.

The researchers confirmed that portable devices like a Raspberry Pi, configured in USB gadget mode, could theoretically conduct this attack, though the Flipper Zero currently lacks the necessary FaceDancer backend. This underscores the potential for highly discreet physical compromise using readily available hardware.

NoPlug & Pwn: Remote Exploitation via RDP USB Redirection

Beyond physical access, the researchers also demonstrated “NoPlug & Pwn,” an attack that requires no physical hardware emulation on the target system. This variant exploits the RDP USB redirection feature, which is intended to make local USB devices available within a remote Windows session. Instead of redirecting an actual device, the attackers developed a Python RDP client that sends specific USB descriptors over this redirection channel. This allows remote attackers to trigger the same privileged software installations and subsequent SYSTEM privilege escalation without ever physically touching the machine. This “RDP USB redirection vulnerability” significantly broadens the attack surface for Windows systems.

Impact and Broader Context

These “Plug and Pwn” attacks belong to a family of vulnerabilities previously highlighted by the 2021 Razer Synapse flaw, where simply plugging in a Razer device allowed a standard user to gain SYSTEM privileges due to a vulnerability in the automatically installed Razer installer. Vulnerability analyst Will Dormann had previously warned that similar flaws were likely present in other software installed via Windows Plug and Play. The new research by Hernando and Martínez validates these concerns, focusing on the Windows device installation path itself rather than a single vendor’s installer. This indicates a systemic issue where the automated, privileged installation of vendor software can introduce critical security weaknesses. Understanding the potential for “Windows Plug and Play SYSTEM privileges exploit” is crucial for modern network defense.

Actionable Recommendations and Mitigations

Defenders must prioritize measures to mitigate the risks posed by Plug and Pwn attacks. While a direct patch for the core Windows Plug and Play behavior is unlikely, several strategies can help reduce exposure:

• Restrict USB Device Usage: Implement strict policies regarding the connection of unknown or untrusted USB devices. Endpoint detection and response (EDR) solutions can help monitor and block suspicious USB activity.
• Disable RDP USB Redirection: For servers and critical workstations, disable RDP USB redirection functionality if it is not absolutely essential. This closes the avenue for “how to mitigate Plug and Pwn attacks” conducted remotely via RDP.
• Regular Software Audits: Periodically audit vendor-supplied software installed via Plug and Play for known vulnerabilities. Prioritize patching or removal of unnecessary co-installers and support executables that run with SYSTEM privileges.
• Least Privilege Principle: While Plug and Play bypasses UAC, ensure that other system configurations adhere to the principle of least privilege, limiting the potential impact of any successful compromise.
• Network Segmentation: Isolate critical systems where possible to limit lateral movement potential even if SYSTEM privileges are gained on an endpoint.
• Monitor for Anomalous Activity: Implement comprehensive logging and monitoring for anomalous processes running with SYSTEM privileges, unexpected DNS changes, or unauthorized file downloads, especially on endpoints.

By addressing the underlying pathways exploited by Plug and Pwn, organizations can significantly enhance their defenses against these sophisticated privilege escalation techniques.

Related: Zoom CVE-2026-53412: Critical Windows Client Account Takeover Fix, Pass-ta-key Attacks Hijack Google-Synced Passkeys on Windows