Security experts have unveiled a novel method to gain SYSTEM-level access on Windows 11 via USB Plug and Play mechanisms. This vulnerability allows signed vendor software for emulated USB devices to execute privileged installation components, leading to a full SYSTEM takeover on an up-to-date system.
Exploiting Plug and Play on Windows
The researchers, Alejandro Hernando and Borja Martinez, presented their findings at DEF CON 34 under the title ‘Plug And Pwn: Weaponizing Windows PnP Auto-Install’. They demonstrated how an unprivileged user can transform the Plug and Play installation path into SYSTEM code execution by emulating arbitrary USB devices.
Through their method, a Sierra Wireless device is emulated, triggering Windows to install SwiService.exe, a SYSTEM service. This service allows DNS redirection, which is further manipulated by emulating a Sony FeliCa reader. The reader’s co-installer retrieves configuration files over unsecured HTTP, which can be used to introduce a DLL into the System32 directory, ultimately enabling SYSTEM access.
Remote Exploitation via RDP
The vulnerability is not limited to physical USB devices. By utilizing Remote Desktop Protocol (RDP), the same exploit can be replicated with synthetic USB traffic. A Python client simulates a phantom Intel RealSense device, prompting Windows to engage in a redirected installation path.
This remote variant relies on configuration settings, as Microsoft does not enable Plug and Play redirection by default in RDP. Nevertheless, if enabled, it can lead to SYSTEM code execution by exploiting a CRYPTBASE.dll search-order hijack from a writable installation directory.
Security Implications and Recommendations
The research highlights significant security concerns regarding the use of legitimate installation paths and third-party vendor packages. Microsoft acknowledges that Remote Desktop Services do not support Plug and Play redirection by default and has issued guidance on USB redirection configurations.
For enterprises, it is crucial to disable any unnecessary USB redirection features and implement device-installation restrictions to prevent unauthorized access. This includes controlling device permissions by hardware ID, compatible ID, and setup class, particularly on Remote Desktop servers.
The findings underscore the importance of staying vigilant against potential vulnerabilities and ensuring robust security measures are in place to protect against sophisticated attacks.
