Plug and Pwn attacks exploit Windows PnP for SYSTEM

At DEF CON 34, security researchers Alejandro Hernando and Borja Martínez unveiled a new class of attacks they call "Plug and Pwn," which abuse the Windows Plug and Play feature to trick the operating system into installing vulnerable vendor software and ultimately grant SYSTEM privileges. The attacks, which can be executed with physical USB emulation or even remotely over RDP, highlight a fundamental risk in how Windows automatically handles new hardware.

Abusing Windows Plug and Play

Windows includes a feature called co-installers, which automatically downloads and installs vendor software and drivers when a new USB device is plugged into a computer. This convenience is the foundation of the Plug and Pwn attacks, as the installation process runs with the highest privileges—NT AUTHORITY\SYSTEM—and can include co-installers, services, support executables, and drivers, all without displaying a UAC prompt.

In 2021, BleepingComputer reported on a similar issue involving Razer Synapse, where plugging in a Razer mouse or keyboard triggered the automatic installation of Razer software with SYSTEM privileges, and a flaw in the installer allowed a standard user to launch PowerShell and inherit those privileges. At the time, vulnerability analyst Will Dormann warned that other vendor software installed through Plug and Play might have similar vulnerabilities. Hernando told BleepingComputer that Plug and Pwn belongs to the same family, but with a key difference: "The Razer bug is the same family. The difference is that we went after the install path itself instead of one vendor's installer."

"Some of our chains need no clicks and no logged-on session, and one of them runs over RDP with no hardware at all."

— Alejandro Hernando, security researcher, speaking to BleepingComputer

From fake USB devices to SYSTEM shells

The researchers used FaceDancer, a software framework for emulating USB devices, running on Cynthion and GreatFET hardware connected to a small Linux computer. This setup makes the operating system behave as though a specific USB device had been plugged in, causing Windows to recognize the emulated hardware and install the associated vendor driver packages. Some attack chains require the emulated device to disconnect and then reappear as a different identity, as Hernando explained: "Several of our chains depend on presenting the device as composite so Windows loads usbccgp.sys and enumerates each interface on its own, which is what makes it match the vendor package instead of the inbox driver. We also need to re-enumerate on demand, dropping the device and coming back as a different identity."

In their zero-click physical demonstration, the researchers exploited behaviors in Sierra Wireless and Sony FeliCa installation packages. The attack first impersonates a Sierra Wireless device, causing Windows to install software that can be abused to change the computer's DNS settings. Then, impersonating a Sony FeliCa device, Windows installs additional Sony software that downloads files over an unencrypted connection. By controlling the system's DNS settings, the researchers redirect those downloads to a server they control and exploit a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges. Finally, they impersonate the Sierra device again, causing Windows to load the malicious file and open a reverse shell with SYSTEM privileges. This chain was demonstrated against a fully updated Windows 11 computer with nobody logged in, taking approximately five minutes.

Portable attack hardware and limitations

When asked if the attack can be conducted with small portable devices, Hernando said their research hardware is already portable enough to carry around, and a Raspberry Pi operating in USB gadget mode should theoretically be capable of conducting this attack as well. However, the Flipper Zero cannot currently perform the FaceDancer attacks. "Flipper Zero, no. There's no FaceDancer backend for it and the framework won't run on it. Its BadUSB mode is fine for HID, but arbitrary composite descriptors and re-enumeration would be a firmware project," he said.

NoPlug & Pwn: remote attacks over RDP

The researchers also demonstrated "NoPlug & Pwn," which requires no physical hardware emulation. Instead, the attack abuses RDP USB redirection, a feature that allows USB devices attached to a user's local computer to be available inside a remote Windows session. Rather than redirecting an actual device, the researchers created a Python RDP client that sends specific USB descriptors over this redirection feature when connecting over RDP. The remote Windows host then treats the fake descriptors as a legitimate USB device, creates the corresponding Plug and Play device, and installs the associated drivers and vendor software.

In their demonstration, they impersonated an Intel RealSense camera whose Windows Update package contains a co-installer that can be abused through DLL hijacking to obtain SYSTEM privileges. "The server's USB hub driver enumerates our phantom device, and Windows PnP does exactly what it did in the physical demo: it matches the hardware ID and installs the driver, as SYSTEM," the researchers explain on the Plug and Pwn site. The RDP attack only works on systems where USB redirection is enabled, which Hernando says is common in virtual desktop environments.

Mitigations and remaining risks

Will Dormann suggested that Windows administrators concerned about this type of attack can enable the 'DisableCoInstallers' registry value, which prevents driver packages from executing co-installers during device installation. To do this, open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer Registry, then add a DWORD-32 value named DisableCoInstallers and set it to 1.

When asked whether this would effectively block Plug and Pwn, Hernando said it would disrupt some of the demonstrated attacks, including the Sony FeliCa attack and the Intel RealSense RDP attack. However, it does not eliminate the underlying attack surface. "It helps, and it would break parts of what we showed," Hernando told BleepingComputer. "It doesn't stop the class of attack, though. It leaves PnP enumeration, Windows Update resolution, driver staging, INF processing and INF-installed services untouched."

The researchers illustrated this with another attack using Wacom and Atheros packages that exploits a vulnerability (CVE-2019-10617) in an Atheros driver service installed through an INF file rather than a co-installer.

What this means for Windows security

Hernando recommends that organizations with sensitive systems use 'DisableCoInstallers' along with additional device blocking. "In anything sensitive I'd pair it with device installation restrictions or hardware-ID allow-lists, and turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)," he told BleepingComputer.

The researchers have not reported all of the attack scenarios as new vulnerabilities to individual vendors, saying that many are not standalone security flaws and only become exploitable when combined with other functionality. This suggests that the attack surface is broader than any single vendor fix, and that Windows' core behavior of automatically installing software for new hardware, while convenient, carries inherent risks that may not be fully addressed by patching individual packages.