A set of fully-undetectable process injection techniques abusing Windows Thread Pools
A set of fully-undetectable process injection techniques abusing Windows Thread Pools
A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
| Variant ID | Varient Description |
|---|---|
| 1 | Overwrite the start routine of the target worker factory |
| 2 | Insert TP_WORK work item to the target process's thread pool |
| 3 | Insert TP_WAIT work item to the target process's thread pool |
| 4 | Insert TP_IO work item to the target process's thread pool |
| 5 | Insert TP_ALPC work item to the target process's thread pool |
| 6 | Insert TP_JOB work item to the target process's thread pool |
| 7 | Insert TP_DIRECT work item to the target process's thread pool |
| 8 | Insert TP_TIMER work item to the target process's thread pool |
PoolParty.exe -V -P Insert TP_TIMER work item to process ID 1234
…The default shellcode spawns a calculator via the WinExec API.
To customize the executable to execute, change the path in the end of the g_Shellcode variable present in the main.cpp file.
No open issues yet, or sync has not completed.