Plug And Pwn Weaponizing Windows PnP Auto Install

The talk examines how Windows Plug and Play can silently fetch a signed vendor driver package when a USB device appears and run its installer code as SYSTEM, without administrator rights. The presenters, from Accenture's offensive security team, opened with a live demo on a fresh Windows 11 machine. They then chained two low-severity flaws from separate vendors: a named pipe exposed by a modem service that let them change the machine's DNS, and a co-installer that trusted configuration files fetched over plain HTTP and allowed path traversal into System32. Hardware was emulated with FaceDancer rather than real devices.

The second part moved the same install path onto RDP USB redirection. The server builds a device from descriptors the client sends, and a group policy setting decides whether that device is accepted. Where that gate was open, a forged camera identity sent by a standard user session triggered a DLL hijack in a signed camera package, giving SYSTEM code execution with no physical access. The team also described PnP Simulate, a tool for comparing Windows Update discovery with the real installation flow, and noted that many matches never reached automatic installation. Further stages used a vendor service with a hard-coded check and a registry-writing admin service.

The takeaways were that a valid signature says little about whether every service and installer was reviewed from an attacker's viewpoint, and that low-severity bugs can combine into serious impact. Mitigations mentioned included blocking unneeded USB device classes, disabling RDP USB redirection where it is not needed, and keeping drivers updated. The presenters said proof-of-concept code and tooling would be published.