Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

Researchers Alejandro Hernando and Borja Martinez demonstrated a privilege escalation technique called 'Plug And Pwn' that abuses Windows Plug and Play (PnP) auto-install functionality to achieve SYSTEM-level code execution on fully updated Windows 11 systems. The attack chain involves emulating a Sierra Wireless USB device to trigger installation of SwiService.exe, a SYSTEM service used to manipulate DNS settings, followed by emulating a Sony FeliCa reader that downloads configuration over HTTP, enabling a path-traversal vulnerability to drop a malicious DLL into System32. Reconnecting the Sierra device loads the DLL via a privileged service, resulting in SYSTEM compromise. A remote variant using RDP with USB redirection enabled abuses a similar path via Intel RealSense software and a CRYPTBASE.dll search-order hijacking from a user-writable directory.

AI-extracted · verify before operational use