In this blog I'll explain how this can be done using an USB armory. While running software automatically is no longer possible on recent versions of Windows there are still possibilities to trick a user into running malicious software from a USB thumb drive - handy if you're Red Teaming for example. On Vista and later, the user will always see the AutoPlay dialog for CD-ROMs (under default configuration). As of Windows Vista, the AutoRun feature is disabled by default.

In case of USB thumb drives containing an autorun.inf file, the user is always presented the AutoPlay dialog. Windows XP still supports running software automatically when a CD-ROM is inserted. With AutoPlay a user is presented with suggested actions when removable media is inserted. First of all the AutoPlay was introduced in Windows XP.

Due to this, Microsoft has added restrictions to when software on removable media can or will run. Of course it is not hard to see the security risks associated with automatically running software from removable media. It probably made sense to design it like this as it made it easy for non-technical people to install/run software from a CD-ROM. Back then the threat landscape was a lot different from what it is today.

In case it contains an open or shellexecute (Windows 2000/ME and later) entry, Windows would automatically launch the program configured in this entry. Back then when a (software) CD-ROM was inserted in the CD-ROM drive, Windows would parse the autorun.inf file on the CD. AutoRun is a feature of Windows that was introduced in Windows 95.

Autorun win 10