Researchers have unveiled a critical exploit involving Windows Plug and Play (PnP) drivers that can lead to SYSTEM-level access without user interaction. This method, dubbed the Plug and Pwn attack, was detailed by cybersecurity experts Alejandro Hernando and Borja Martínez. Unlike traditional exploits, this approach does not depend on a zero-day vulnerability in the Windows kernel. Instead, it takes advantage of the operating system’s process for identifying and installing hardware drivers.
How the Plug and Pwn Attack Works
The attack is initiated when a USB device is connected to a Windows 11 machine, even if no user is logged in. The attacker can mimic a device using a tool like FaceDancer, prompting Windows to resolve its driver package and execute vendor code with elevated privileges. This method exploits vulnerabilities initially found in Sierra Wireless and Sony FeliCa software, where a service running as SYSTEM exposes a named pipe that grants extensive access.
By manipulating this access, attackers can change the DNS server of the target system. They then emulate a Sony device, triggering the download of configuration data via unsecured HTTP connections. By redirecting network traffic to an attacker-controlled server, malicious files can be delivered, leading to an arbitrary file write executed with SYSTEM privileges.
Remote Exploitation and NoPlug and Pwn
The Plug and Pwn attack also describes a remote variant known as NoPlug and Pwn. This targets environments with RDP USB redirection enabled, such as some Virtual Desktop Infrastructure (VDI) setups. Here, an ordinary RDP user can send crafted USB descriptors over the URBDRC channel, causing the remote host to enumerate a non-existent device.
A demonstration with an Intel RealSense driver package shows how the installer can run an executable from a directory accessible by standard users, allowing DLL sideloading during SYSTEM-level installation. The researchers have also developed PNP Simulate, a tool to analyze the driver discovery and installation pathway without physical hardware.
Implications and Security Recommendations
Testing reveals that Windows Update metadata may show numerous compatible packages, but only a few are automatically eligible for Plug and Play installation. Another example combines Wacom and Atheros packages, with the Atheros service permitting SYSTEM-level registry modifications. Conversely, the Wacom service exploits a registry path to launch commands as SYSTEM.
The findings underscore that signed drivers and trusted update processes alone do not ensure security. Organizations are advised to limit USB device connections, disable unnecessary RDP USB redirection, control driver installations, monitor unusual driver package downloads, and scrutinize vendor installers and privileged operations.
Particularly, administrators managing VDI systems with USB redirection should review their security measures, as standard remote sessions could expose critical Plug and Play vulnerabilities. Enhancing SOC capabilities through tools like ANY.RUN can further bolster threat detection and response efforts.
