Plug and Pwn: Abusing the Plug-and-Play Mechanism to Gain SYSTEM Access

The Plug and Pwn research demonstrates a new class of attacks in which an attacker abuses the built-in Plug-and-Play mechanism in Windows to automatically install drivers and OEM components with NT AUTHORITY\SYSTEM. The attack relies on emulating USB devices with spoofed hardware IDs, causing the OS to load and execute potentially vulnerable components without user interaction. As a result, the attacker can escalate privileges not by exploiting the kernel, but by abusing the trusted driver installation chain.

A key feature is the ability to build exploit chains (co-installers, DLL hijacking, insecure downloads) that enable full control of the system even on a fully updated Windows installation. In addition to the physical scenario, the research includes a NoPlug & Pwn variant, in which the attack is carried out remotely through RDP USB redirection, triggering the same driver installation process. Thus, the work highlights a systemic problem in the Windows driver ecosystem, where signed and outdated packages remain available and can be used for privileged compromise.

Article: https://plugandpwn.com/