Windows Plug and Play can be exploited to obtain signed vendor software on an emulated USB device, allowing for privileged installation components to be executed via researchers with SYSTEM access on a fully updated Windows 11 system. This technique is demonstrated in "Plug And Pwn: Weaponizing Windows PnP Auto-Install," presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martinez. They crafted tooling to mimic any arbitrary USB devices, allowing an unprivileged user to transform the Peripheral-Component Interconnect (PnP) installation path into SYSTEM code execution under specified conditions.
Following the research findings, they begin by creating an imitation of a Sierra Wireless device, which installs SwiService.exe—a SYSTEM service that exposes a SetDNS primitive.
Next, they emulate a Sony FeliCa reader, which retrieves configuration files via plaintext HTTP and generates local filenames based on URL paths. The researchers revealed that a path traversal vulnerability allows them to place a DLL in System32; reattaching the Sierra device subsequently loads the inserted DLL and grants SYSTEM-level access. A remote variant shifts control by using synthetic USB traffic through Remote Desktop Protocol (RDP).
Microsoft offers device-installation restrictions that allow or block devices based on hardware, compatible ID, device-instance ID, and setup class settings; these policies also impact redirected devices on Remote Desktop servers.
