Security researchers have demonstrated a new attack technique that abuses Windows Plug and Play (PnP) auto-install to achieve full SYSTEM privileges on a fully updated Windows 11 machine. The research, titled “Plug And Pwn: Weaponizing Windows PnP Auto-Install,” was presented at DEF CON 34 by Alejandro Hernando and Borja Martinez.
The attack chain begins by emulating a USB device, such as a Sierra Wireless modem, which triggers Windows to install signed vendor software. The researchers exploit a path traversal vulnerability in a Sony FeliCa reader co-installer to place a malicious DLL in System32. Reconnecting the emulated device then loads the planted DLL, resulting in SYSTEM code execution.
The technique also works remotely over Remote Desktop Protocol (RDP) when Plug and Play or low-level USB redirection is enabled. By forging a phantom Intel RealSense device, the researchers achieve SYSTEM access through a CRYPTBASE.dll search-order hijack. Microsoft notes that USB redirection is not enabled by default, and administrators can disable it or use device-installation restrictions to mitigate the risk.
The research highlights the dangers of abusing legitimate privileged installation paths and weaknesses in signed third-party packages. The vendor-specific exploit mechanics remain researcher findings and should be attributed accordingly.
Companies: Microsoft, Sierra Wireless, Sony, Intel
Products: Windows 11, Remote Desktop Services
Events: DEF CON 34
Original source: thehackernews.com