DEV Community

Anoymask
Anoymask

Posted on

Plug and Pwn: Getting Windows SYSTEM Privileges from Fake USB and RDP Devices

#security #threatintel

Plug and Pwn: Getting Windows SYSTEM Privileges from Fake USB and RDP Devices

1. Basic Information

2. One-Sentence Summary

This research shows that simply connecting a fake USB device or a virtual USB via RDP can trick Windows Plug and Play into installing official drivers with SYSTEM privileges, leading to a reverse shell by chaining the installation process and known vulnerabilities.

3. Attack Flow

Chain A: Zero-Click SYSTEM Execution via Physical USB

  1. The attacker uses FaceDancer, Cynthion, or GreatFET to fake a USB device descriptor.
  2. Windows recognizes it as a Sierra Wireless device, automatically downloads a signed vendor package from Windows Update, and installs it with SYSTEM privileges.
  3. The installed components are used to change DNS settings.
  4. The same device re-enumerates as a Sony FeliCa device to download extra software via HTTP.
  5. Poisoned name resolution points the download to the attacker, who writes malicious files with SYSTEM privileges.
  6. The device re-enumerates as a Sierra device again, loads the malicious files, and gets a SYSTEM reverse shell.

Chain B: NoPlug and Pwn (RDP)

  1. The attacker redirects a crafted USB descriptor through an RDP connection.
  2. The remote Windows creates it as a local PnP device and selects the Intel RealSense driver package.
  3. It abuses the load path of the co-installer DLL to run code with SYSTEM privileges.

Chain C: Old Driver Vulnerabilities

  1. The device enumerates as a composite USB device and offers multiple functions via usbccgp.sys.
  2. The INF installs an old driver as a service.
  3. Known vulnerabilities, such as CVE-2019-10617, are used for local privilege escalation.

4. Attacker Position and Execution Location

  • Chain A starts with a person who has physical access to the device's USB port or a malicious peripheral.
  • Chain B presents a virtual USB from the RDP connection source, and the code runs with SYSTEM privileges on the destination Windows.
  • Driver acquisition, INF processing, and co-installers are executed by the Windows PnP and update systems with SYSTEM privileges.

5. Visibility for Victims and Administrators

  • No user logon or UAC approval is needed. It looks like a normal "Setting up a device" behavior.
  • Administrators will see the enumeration of different vendor devices in a short time, driver downloads from Windows Update, network setting changes, and SYSTEM child processes.
  • In an RDP environment, it is observed as a PnP creation from a remote session, even without a physical USB.

6. Conditions for Success and Failure

Conditions for Success

  • USB connection or RDP Plug and Play redirection is allowed.
  • Compatible driver packages can be downloaded from Windows Update.
  • Vulnerable processes remain, such as co-installers of the target package, HTTP downloads, or old drivers.
  • Device installation restrictions are not applied.

Conditions for Failure

  • The system rejects installations other than allowed Hardware IDs or Device Classes.
  • RDP PnP redirection is disabled.
  • Driver download sources and HTTP downloads are blocked.
  • A blocklist of old vulnerable drivers and application control are applied.

7. What Happens on Success

Without user action, the attacker can create files with SYSTEM privileges, load DLLs, create services, change network settings, and get a reverse shell. The published content is a research demo and is not confirmed to be used in actual attack campaigns.

8. Observable Logs

  • Email: None in principle. This is only relevant if malicious peripherals are delivered (Hypothesis).
  • Proxy/SWG/DNS: Windows Update or vendor downloads, HTTP downloads of Sony software, and immediate DNS changes followed by communication with the attacker.
  • Endpoint/EDR: Kernel-PnP, DriverFrameworks, SetupAPI, C:\Windows\INF\setupapi.dev.log, new drivers or services, and abnormal DLLs or shells run by SYSTEM.
  • Identity/IdP: RDP authentication, connection source, session ID. The physical chain has no authentication events.
  • SaaS/Cloud: Usually none.
  • Network: RDP USB virtual channel, driver downloads, connections after DNS changes, and reverse shells.

9. Attack Success Determination

  • Contact Only: USB insertion or RDP connection only.
  • Initial Execution Prep: New PnP enumeration, vendor package download.
  • Initial Execution: SYSTEM-privilege co-installer, service, or malicious DLL load.
  • Compromise Success: DNS modification, SYSTEM shell, external C2 connection.
  • Follow-on Compromise: Credential theft, persistence, and lateral movement only occur if additional evidence is found.

10. Investigation Playbook

  • Trigger: Unauthorized USB, PnP device creation during RDP, rapid re-enumeration of multiple vendors, SYSTEM network traffic.
  • Initial Check: Determine connection time, Hardware ID, Device Instance ID, RDP session, and presence of an operator.
  • Endpoint: Preserve SetupAPI, PnP events, DriverStore, INF, services, DNS settings, process tree, and memory.
  • Authentication/Cloud: Check RDP logon and source, RD Gateway, MFA, and session reconnection.
  • Follow-up Actions: Check for SYSTEM shells, credential access, persistence, and lateral movement.
  • Containment: Consider device isolation, stopping USB or RDP redirection, removing malicious drivers and services, restoring DNS, and rebuilding.
  • Judgment Categories: Device Presented / Driver Installed / SYSTEM Execution / C2 Confirmed / Follow-on Compromise.

11. Defense and Detection Ideas

  • Single Event: Unauthorized Hardware ID, new PnP during an RDP session, HTTP download by SYSTEM, DNS change right after driver installation.
  • Timeline Correlation: USB enumeration -> Signed driver download -> Re-enumeration to another vendor -> DNS change -> Outbound SYSTEM traffic.
  • Hunting: SetupAPI showing multiple vendors in a short time, co-installer DLLs, new kernel services, old vulnerable drivers.
  • Log Gaps: Requires USB asset inventory, SetupAPI collection, RDP virtual channels, and DNS setting change logs.
  • Priority Actions: Device Installation Restrictions, Hardware ID allowlist, fDisablePNPRedir, blocking vulnerable drivers, and blocking HTTP downloads.

12. Facts / Inference / Hypothesis

Facts

  • Researchers demonstrated a physical chain on a fully updated Windows 11 that reached a SYSTEM shell in about 5 minutes from a logged-out state.
  • They also demonstrated "NoPlug and Pwn," which works using only RDP USB redirection.
  • Windows runs part of its PnP packages with SYSTEM privileges without UAC.
  • DisableCoInstallers alone cannot stop this entire class of attacks.

Inference

  • In VDIs, jump servers, and shared conference room terminals, RDP redirection settings act as a boundary equal to physical port control.

Hypothesis

  • The physical chain can be used in actual attacks by delivering malicious peripherals, leaving them in conference rooms, or posing as maintenance personnel.

13. MITRE ATT&CK Mapping

  • High Confidence: T1200 Hardware Additions, T1068 Exploitation for Privilege Escalation, T1543.003 Windows Service, T1105 Ingress Tool Transfer, T1059.003 Windows Command Shell.
  • Medium Confidence: T1021.001 RDP, T1562.001 Impair Defenses, and credential access after T1098 only if follow-up actions are confirmed.

14. Unknowns and Additional Investigation

  • The scope of permanent fixes by Microsoft and various vendors.
  • Whether this is used in real attacks and the total number of vulnerable packages.
  • Reproducibility across different Windows SKUs and enterprise update management configurations.

15. Impact on SOCs and Organizations

Organization endpoints such as VDIs, remote maintenance tools, and factory, conference room, or reception terminals often trust PnP implicitly. Organizations must include not only USB control products, but also RDP redirection, driver downloads, and SetupAPI logs in their asset management and SOC monitoring scope.

16. Summary by Target Audience

  • For SOCs: Correlate PnP enumeration, driver downloads, SYSTEM execution, and DNS changes. Distinguish between research demos and real compromises.
  • For Administrators: Prioritize USB device allowlists and disabling RDP PnP redirection.
  • For Users: Do not connect unknown USB devices. Report immediately if an automatic setup starts after connecting a device.

Top comments (0)