plugandpwn.com :: Plug and Pwn
Abstract
Every time a USB device is plugged into a Windows machine, the operating system may silently download<br>a package from Microsoft and execute vendor code as NT AUTHORITY\SYSTEM. That can happen without<br>administrator privileges, without a logged-on user, and in some environments even remotely through<br>RDP USB redirection.
This is the release kit for the DEF CON 34 talk. We are publishing everything, including the tooling, so you<br>can reproduce the PnP part and check these primitives yourself.
[00] Plug & Pwn: physical zero-click chain (Sierra + Sony)
[01] NoPlug & Pwn: RDP USB redirection, no hardware
[02] PnP internals & PNP simulate
[03] vendor composition: Wacom + Atheros LPE
[04] source, scripts
whoami
$cat ~/operators/0xedh
Alejandro Hernando 0xedh
red_team_operator · vulnerability_researcher
Alejandro Hernando is a red team operator and security researcher with over a decade of hands-on<br>experience in offensive cybersecurity. Throughout his career,<br>he has assessed, exploited, and helped mitigate security vulnerabilities across commercial and<br>proprietary systems, developing PoC exploits, offensive and defensive tooling, and conducting deep<br>security research. His approach combines applied research with real world operational experience,<br>driven by a focus on continuous learning and on sharpening both attack and defense strategies.
find me on
$cat ~/operators/borjmz
Borja Martinez borjmz
red_team_operator · vulnerability_researcher
Borja Martínez is a red team operator and security researcher focused on offensive security, advanced<br>adversary simulation and hardware exploitation.<br>A self-taught hacker with a deeply hands-on approach, he specializes in red team operations,<br>penetration testing and low level attack research including DMA attacks, BIOS/UEFI exploitation, and<br>TPM security.
find me on
Vectors
Every time a USB device is plugged into a Windows machine, the OS may silently download a package from<br>Microsoft and run vendor code as NT AUTHORITY\SYSTEM. It can happen with no administrator<br>privileges and no logged-on user. Under the right conditions it also works remotely, with nothing plugged<br>into the machine at all. The vectors below walk each path to that install flow, and the vendor primitives it<br>ends up delivering.
[00] Plug & Pwn: physical zero-click chain (Sierra + Sony)
The setup: on the left, a fully updated Windows 11 box, no user logged in, nothing pre-installed. On the<br>right, a Linux machine with a FaceDancer, emulating USB devices. It goes from nothing to SYSTEM with zero<br>clicks. The real run takes about five minutes. At the end we drop a marker file and pop a SYSTEM shell,<br>just to show it is the real thing.
POC 0 // zero-click physical chain: Windows 11 (no logon) to SYSTEM shell, ~5 min sped up. Left: target. Right: FaceDancer attacker box.
This is one example of what the install path allows. We chain low-severity vulnerabilities from different<br>vendors (some vendors don't even consider them vulnerabilities) so that together they make a higher impact.<br>The physical chain runs like this:
Emulate a specific Sierra device with a FaceDancer, then poll an unrestricted named pipe created by the vulnerable component itself.
Once the pipe exists, use it to change the machine's default DNS. We serve a DNS that redirects everything to Google DNS except for our target.
Emulate a Sony device. Once its service installs, it downloads components over HTTP from Sony servers. We control the DNS, so we are those Sony servers.
Serve specific files to exploit it: an arbitrary write as SYSTEM. We write a DLL into System32.
Emulate the Sierra device again to get our planted DLL loaded. That is arbitrary code execution as NT AUTHORITY\SYSTEM, before any user logs in.
Physical chain, steps 1 to 7: Sierra sets the DNS, Sony writes the DLL into System32, Sierra reloads it, SYSTEM.
Sierra Wireless: SwiService.exe
The Sierra Wireless service runs as SYSTEM and exposes a named pipe with an Everyone read/write<br>ACL. Any local user, or any domain user, can connect and call the SetDNS function, locally or<br>even over SMB. We point this DNS at the attacker address and replace the Sony lookups with our own server.<br>The executable is hardcoded to netsh and the interface name comes from a system lookup and is<br>not injectable. That doesn't matter: the effect we want, pointing DNS at any IP, is exactly what the attack<br>needs.
Sony FeliCa: felica_coinst.dll
The root cause is a signed catalog file with a co-installer DLL that runs as SYSTEM. During plug and play<br>it fetches configuration files over plaintext HTTP, trusting everything it receives. The orchestrator pulls<br>three text files over HTTP (an installation list, a URL list, and application info) and decides what to<br>install.
When it downloads those files, it derives the on-disk filename by taking everything after the last forward<br>slash in the URL. There is no filtering of...