Thread Pool API is a mechanism in Windows that allows efficient management of multiple worker threads, enabling asynchronous execution of tasks. The API provides functions such as CreateThreadpoolWork, SubmitThreadpoolWork, and WaitForThreadpoolWorkCallbacks to create and execute work items in a thread pool. Attackers can exploit this functionality to execute shellcode in a stealthy manner by leveraging the thread pool callback mechanism.
Key Concepts:
Thread Pool: A collection of worker threads managed by the Windows kernel, allowing efficient execution of asynchronous tasks.
Thread Pool Work Item: A task submitted to the thread pool for execution.
Callback Function: A function executed by a worker thread in response to a work item submission.
Execution Flow Hijacking: By injecting shellcode into memory and registering it as a thread pool callback, an attacker can execute arbitrary code within the context of a legitimate process.
Execution Flow
Shellcode Preparation & Memory Setup:
The shellcode is embedded within the executable and stored as a byte array.
Memory is allocated in the current process using NtAllocateVirtualMemory with PAGE_READWRITE permissions.
The shellcode is copied to the allocated memory using NtWriteVirtualMemory.
The memory region containing the shellcode is then marked as PAGE_EXECUTE_READ using NtProtectVirtualMemory.
Thread Pool Work Item Creation:
CreateThreadpoolWork is called with the shellcode address as the callback function.
Submitting the Work Item:
SubmitThreadpoolWork enqueues the work item for execution.
Execution:
A worker thread from the pool picks up the work item and executes the shellcode.
Cleanup:
The work item is closed using CloseThreadpoolWork to clean-up
Practice
The following code implements this technique:
We can compile it from linux using following command
