PoolParty-一组完全无法删除的过程注入技术滥用Windows线程池

[taibeihacker]

滥用Windows线程池的完全无法选择的过程注入技术的集合。 Presented at Black Hat EU 2023 Briefings under the title - injection-techniques-using-windows-thread-pools-35446'The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools

PoolParty Variants​

Variant ID Varient Description 1 Overwrite the start routine of the target worker factory 2 Insert TP_WORK work item to the target process's thread pool 3 Insert TP_WAIT work item to the target process's thread pool 4 Insert TP_IO work item to the target process's thread pool 5 Insert TP_ALPC work item to the target process's thread pool 6 Insert TP_JOB work item to the target process's thread pool 7 Insert TP_DIRECT work item to the target process's thread pool 8 Insert TP_TIMER work item to the target process's thread pool

Usage​

PoolParty.exe -V VARIANT ID -P TARGET PID

Usage Examples​

Insert TP_TIMER work item to process ID 1234
poolParty.exe -v 8 -p 1234
[INFO]启动PoolParty攻击进程ID: 1234
[INFO]检索到目标过程: 000000000000000000B8
[INFO]目标过程劫持工厂手柄: 0000000000000000000058
[INFO]目标过程中劫持的计时器队列句柄: 000000000000000000054
[INFO]目标进程中分配的外壳内存: 00000281DBEF0000
[信息]书面壳代码到目标过程
[信息]检索目标工厂的基本信息
[INFO]创建了与ShellCode关联的TP_TIMER结构
[信息]目标进程中分配的TP_TIMER内存: 00000281DBF00000
[INFO]将特殊精心制作的TP_Timer结构写成目标过程
[INFO]修改了目标过程的TP_POOL TIEMR队列列表条目，指向特殊精心设计的TP_Timer
[INFO]设置计时器队列到期以触发Dequeueing tpptimerqueueexp Iration
[INFO] POOLPARTY攻击成功完成了

Default Shellcode and Customization​

默认的ShellCode通过Winexec API产生了计算器。
要自定义执行执行的执行，请在main.cpp文件中存在的g_shellcode变量末端更改路径。

Author - Alon Leviev​

LinkedIn -Alon Leviev Twitter- @_0xdeku