Plug and Pwn Attack Exploits Windows PnP Drivers for Zero-Click Privilege Escalation

Researchers Alejandro Hernando and Borja Martínez have discovered a vulnerability in Windows PnP drivers that allows an attacker to gain SYSTEM privileges without any user interaction. The technique, known as Plug and Pwn, exploits the process of Windows detecting hardware, downloading vendor packages, and running installation components with SYSTEM rights.

The issue can be triggered when a USB device is connected to a Windows 11 computer, even if no user is signed in. An attacker can emulate a device identity using FaceDancer, which allows them to resolve the driver package and start vendor-supplied code in a privileged installation context.

The researchers demonstrated this vulnerability by chaining weaknesses in Sierra Wireless and Sony FeliCa software. They used a Sierra service running as SYSTEM to expose a named pipe that permits broad access, and then emulated a Sony device to retrieve configuration data over unencrypted HTTP.

By redirecting the Sony domain to an attacker-controlled server, they can provide crafted files that cause an arbitrary file write as SYSTEM. A DLL placed in the Windows System32 directory is later loaded through the Sierra component, resulting in SYSTEM code execution before logon.

The researchers also released PNP Simulate, a tool for examining the driver discovery and installation path without requiring physical hardware. They tested their findings on various devices, including Intel RealSense drivers, Wacom and Atheros packages, and a malicious print monitor DLL loaded by the Windows Print Spooler after a reboot.