Windows Plug and Play Abuse Leads to SYSTEM Takeover via Emulated USB Devices
Researchers have demonstrated a method to escalate privileges to SYSTEM on Windows 11 by exploiting the Plug and Play auto-installation process for emulated USB devices.
Security researchers Alejandro Hernando and Borja Martinez have unveiled a critical vulnerability in Windows 11 that allows an unprivileged user to achieve SYSTEM-level code execution by abusing the operating system's Plug and Play (PnP) auto-installation feature. The technique, detailed in research presented for DEF CON 34, involves tricking the OS into fetching and executing signed vendor software with elevated privileges through the manipulation of emulated USB devices.
The exploit chain begins with the emulation of a specific USB device, such as a Sierra Wireless device. When Windows detects this emulated hardware, it initiates its standard driver installation process. The researchers leveraged this to install a SYSTEM service, SwiService.exe, which exposes a SetDNS primitive. This primitive allows an attacker to redirect DNS queries, a crucial step in further compromising the system.
Following the DNS redirection, the attack chain continues by emulating a second device, a Sony FeliCa reader. The co-installer for this emulated device is designed to fetch configuration files over plaintext HTTP. By manipulating the URL paths, the researchers were able to exploit a path-traversal flaw, enabling them to place a malicious DLL file into the System32 directory. A subsequent reconnection of the initial Sierra Wireless device then triggers the loading of this planted DLL, resulting in SYSTEM code execution.
This physical attack vector was demonstrated on a fully updated Windows 11 system, highlighting the potential impact even on the latest versions. The researchers emphasize that their findings should not be generalized to untested Windows versions without further validation. The core of the exploit relies on abusing a legitimate, privileged installation pathway combined with weaknesses found in signed third-party software packages.
Furthermore, the researchers demonstrated a remote variant of this attack that bypasses the need for physical access. By utilizing USB redirection over Remote Desktop Protocol (RDP), an attacker can trigger the same PnP installation path without physically connecting a device. This is achieved by forging a USB identity and presenting a phantom Intel RealSense device, initiating the same driver-installation process over the RDP connection.
The remote exploit chain leverages a CRYPTBASE.dll search-order hijack. The software installed for the emulated RealSense device can be abused through this mechanism, allowing an authenticated, low-privilege user to gain SYSTEM privileges. This remote attack vector, however, is dependent on specific configurations and is not enabled by default.
Microsoft has acknowledged the findings and noted that USB redirection, including Plug and Play redirection, is not enabled by default in Remote Desktop Services. Administrators can further mitigate these risks by disabling unnecessary redirection features and implementing device installation restrictions based on hardware IDs or setup classes. The company also advises administrators to leave Plug and Play redirection disabled if it is not required for their environment.
This research underscores the importance of securing the entire software supply chain and the potential risks associated with legitimate system features when combined with subtle vulnerabilities. The exploitation of the PnP auto-install process and the reliance on third-party signed software highlight a complex attack surface that administrators must remain vigilant against.