New Plug & Pwn Attack Abuses Windows Plug and Play to Gain SYSTEM Privileges

A newly disclosed “Plug & Pwn,” is a set of attack chains that weaponize Windows Plug and Play (PnP) driver installation to execute vendor-supplied code as NT AUTHORITY\SYSTEM.

Plugandpwn demonstrates how an attacker can abuse trusted device-driver packages delivered through Windows Update without administrator rights, user interaction, or, in certain scenarios, physical USB hardware. The core issue is not a flaw in USB enumeration itself.

Instead, the researchers argue that Windows PnP becomes a privileged delivery mechanism when it automatically resolves a connected device’s hardware identifiers, downloads a matching signed driver package, and runs installation components as SYSTEM.

New Plug & Pwn Attack Abuses Windows Plug and Play

A malicious actor can emulate a device with a targeted vendor ID and product ID, causing Windows to install vulnerable or logically insecure vendor software.

In the physical “Plug & Pwn” proof of concept, a Linux attack machine using FaceDancer hardware emulates Sierra Wireless and Sony devices against a fully patched Windows 11 system with no active user session.

The Sierra component installs a SYSTEM service that exposes a named pipe writable by Everyone. Through the pipe, an attacker can invoke a DNS-setting function and redirect the victim’s DNS traffic.

The chain then emulates a Sony FeliCa device. Its signed co-installer fetches configuration files over unencrypted HTTP and derives filenames from attacker-controlled URLs without adequately filtering backslashes or traversal sequences.

This reportedly enables an arbitrary SYSTEM-level file write, allowing a malicious DLL to be placed in System32. Re-emulating the Sierra device subsequently causes the planted DLL to load, resulting in SYSTEM-level code execution before a user logs in.

The researchers also developed “NoPlug & Pwn,” a remote variant targeting environments where RDP USB redirection is enabled, such as virtual desktop infrastructure deployments.

A standard RDP user can reportedly forge USB descriptors over the URBDRC channel, making the remote Windows host enumerate a device that does not physically exist.

In one proof of concept, the researchers impersonated an Intel RealSense camera. Windows downloaded and installed a Microsoft-signed driver package, whose co-installer reportedly drops an executable into a user-writable directory and executes it as SYSTEM.

By placing a malicious CRYPTBASE.dll alongside that executable, a low-privilege RDP user can trigger DLL sideloading and remotely elevate privileges.

A separate chain combines Wacom and Atheros software packages installed via PnP. The Wacom service contains a code path that can launch an interactive SYSTEM command prompt when a specific registry value is present.

However, writing that value requires administrative access. The Atheros service supplies the missing primitive: it reads a user-controllable configuration file and performs privileged registry modifications.

Plugandpwn bridged the two components by using Atheros to register a malicious print monitor DLL in the registry. After reboot, the Windows Print Spooler loads that DLL as SYSTEM. The DLL can set the required Wacom registry value and restart the Wacom service.

The findings highlight a broader risk: signed, Windows Update-distributed driver packages may be cryptographically trusted yet still expose dangerous installation-time behavior.

Organizations should restrict USB device installation, disable unnecessary RDP USB redirection, inventory legacy driver packages, and monitor for unexpected driver installs, print-monitor registration, DNS changes, and SYSTEM services interacting with the user.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR