Windows' **Plug and Play** (PnP) feature, designed for seamless device integration, can be abused to fetch and execute signed vendor software for emulated USB devices, ultimately leading to privileged installation components that researchers chained to **SYSTEM** access. Security researchers **Alejandro Hernando** and **Borja Martinez** detailed this technique in their upcoming **DEF CON 34** presentation, "Plug And Pwn: Weaponizing Windows PnP Auto-Install." They developed specialized tooling to emulate arbitrary USB devices, proving that under specific conditions, an unprivileged user can leverage the PnP installation path for SYSTEM code execution. According to **Microsoft's** own driver documentation, **Windows** identifies hardware and compatible IDs for a device, then uses this information to locate a matching driver package. ### The Physical Attack Chain The researchers outlined a physical attack chain that begins by emulating a **Sierra Wireless** device. This causes **Windows** to install `SwiService.exe`, a SYSTEM service that exposes a `SetDNS` primitive. This primitive is then used to redirect DNS traffic. Next, they emulate a **Sony FeliCa** reader, whose co-installer retrieves configuration files over plaintext HTTP, deriving local filenames from URL paths.  A critical path-traversal flaw in this process allows the researchers to place a malicious DLL in `System32`. Reconnecting the **Sierra Wireless** device then triggers the loading of this planted DLL, granting SYSTEM privileges. This demonstration was successfully performed on a fully updated **Windows 11** system. ### Remote Exploitation via RDP The researchers also demonstrated a remote variant of the attack, which replaces the physical device emulation with synthetic USB traffic over **Remote Desktop Protocol (RDP)**. Their **Python** client forges a USB identity, presenting a phantom **Intel RealSense** device. This prompts **Windows** to follow the redirected device-installation path.  The resulting **RealSense** software can then be abused through a `CRYPTBASE.dll` search-order hijack from a user-writable installation directory. This allows an authenticated low-privilege user to achieve SYSTEM code execution. **Microsoft** documentation confirms that redirected low-level USB peripherals utilize the same driver-installation process as physical **Windows** computers. ### Mitigation Strategies It's important to note that the remote attack path is configuration-dependent and not a default **Windows** exposure. **Microsoft** states that **Remote Desktop Services** does not allow supported **Plug and Play** and **RemoteFX USB redirection** by default. USB-redirection guidance requires PnP redirection to be explicitly enabled before low-level USB forwarding functions.  Administrators who do not require these features should ensure they remain disabled. **Microsoft** also provides robust [device-installation restrictions](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceinstallation) that can block or allow devices based on hardware or compatible IDs, device-instance IDs, and setup classes. On a **Remote Desktop** server, these policies can also impact redirected devices. The physical attack chain requires an attacker to be able to physically present an emulated USB device to the target machine. This research highlights how legitimate, privileged installation paths, when combined with weaknesses in signed third-party packages, can be exploited for significant privilege escalation. The specific vendor-related exploit mechanics for **Sierra**, **Sony**, and **Intel** remain researcher findings and are attributed as such.