Products
EXPLIoT CloudFuzz
Home  ›  All Blogs  ›  farid  › 

Thick Client Penetration Testing Approach

    farid
    2-June-2021

Thick Client

Thick Client Penetration Testing Approach

Thick Client

Thick client applications, called desktop applications, are full-featured computers that are connected to a network. Unlike thin clients, which lack hard drives and other features, thick clients are functional whether they are connected to a network or not.

While a thick client is fully functional without a network connection, it is only a “client” when it is connected to a server. The server may provide the thick client with programs and files that are not stored on the local machine’s hard drive.

Example Application:
  • Firefox
  • Chrome
  • Burp Suite
  • OWASP ZAP
  • Zoom
  • Desktop games
  • Music Player
  • Text editor

Common Architectures of Thick Clients.

  • Two Tier
  • Three Tier

Two Tier: The two-tier is based on Client-Server architecture. The two-tier architecture is like a client-server application. Direct communication takes place between client and server. There is no intermediate between client and server.

Two Tier Two Tier Architecture

Example Applications:
  • Desktop Games
  • Music Player
  • Text Editor

Three Tier: The three-tier is based on Client - Application Server - Database Server architecture. The Application server is the mediator between client and server, it transfers data from client to server and vice versa.

Three Tier Three Tier Architecture

Example Applications:
  • Firefox
  • Chrome
  • Burp Suite
  • Zap Proxy

As we have understood what thick client is and its architecture, now we’ll move on to penetration testing approach. We have shown some vulnerabilties of thick client

Starting checks (Enumeration)

  • Application Architecture
    • Business Logic
  • Platform Mapping
    • Understanding Application & Infrastructure
  • Languages and Frameworks
  • Network Connection with WireShark/TCPview

Common Tools and Vulnerabilities.

Tools

  • CFF Explorer
  • Wireshark/TCPview/
  • Procmon
  • Detect It Easy
  • Echo Mirage

Vulnerabilities

  • Hardcoded Sensitive Information in Code & Config/Log files
  • Unquoted Service Paths
  • DLL Hijacking
  • SQL Injection
  • Lack of code obfuscation
  • Buffer Overflow

Hardcoded Sensitive information in Code & Config/Log files

Some time developers forget to remove hardcoded sensitive information in the code and config/log files that can be used by malicious actors to perform severe attacks such as authentication bypass, unauthorized access of the server, unauthorized access of APIs, etc.

Hardcoded sensitive information, such as username/passwords, server IP addresses, and encryption keys, can expose the information to attackers. Anyone who has access to the class/exe/DLL files can decompile and discover sensitive information.

To decompile the application, we just need to open the exe file in dnspy tools, as shown below.

Tools dnspy

Hardcoded Credentials

Hardcoded Credentials

Vulnerable Application: Damm Vulnerable Thick Client App (DVTA)

Similarly, config & log files can be reviewed for sensitive information. We often see cases where the application reveals sensitive information in these files.

Note: if the exe file is obfuscated, we can use the de4dot.exe tool to deobfuscate it (There are a few known techniques to deobfuscate code).

Unquoted Service Paths:

When a service is created whose executable path contains spaces and isn’t enclosed within quotes, it leads to Unquoted Service Path vulnerability, which allows an attacker to gain elevated privileges.

After finding the vulnerable service, we need to check the folder permissions. If low/same privilege users have writeable access, privilege escalation is possible.

Command: wmic service get name,displayname,pathname,startmode |findstr /i “auto” |findstr /i /v “c:\windows\” |findstr /i /v “””

Wmic command: The WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands.

Unqouted Service Path Unqouted Serverice Path

Vulnerable Application: Sandboxie-Plus v0.7.4

DLL Hijacking

DLL Hijacking is a way for attackers to execute malicious code on the system. This means that if an attacker can place a file on the system, that file could be executed when the user runs an application vulnerable to DLL Hijacking.

If the application looks for some DLL files that are not present in the location during the runtime, then an attacker can place a malicious DLL file with the same name in that location and escalate the privilege.

Tools Procmon.exe

DLL Hijacking DLL Hacking

Vulnerable Application: Damm Vulnerable Thick Client App (DVTA)

As shown in the screenshot, the path is missing. An attacker can create the folder and DLL file and escalate the privilege.

SQL Injection

A SQL injection attack consists of the insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack in which SQL commands are injected into data-plane input to affect the execution of predefined SQL commands.

According to OWASP

The application uses an SQL server(on the same machine) to maintain the data such as credentials, etc., and if the application has login functionality, that might be vulnerable to SQL injection. An attacker can bypass the authentication and gain access to the application.

Note:

  • We have seen this case in 2 tier applications since they use a SQL/SQLite/MSaccess Server/file to maintain data on the same machine.

  • It is often observed that 3 tier application uses API and that might be vulnerable to SQL injection.

Lack of code obfuscation

Let’s understand what code obfuscation is

Code obfuscation

Code obfuscation is the process of modifying an executable so that it is no longer useful to a malicious actor but remains fully functional. While the process may modify actual method instructions or metadata, it does not alter the program’s output.

Lack of code obfuscation

When developers do not obfuscate the code when compiling the binary, an attacker can decompile the code using some tools such as JD GUI & Dnspy.

To decompile the application, we just need to open the exe file in dnspy tools, as shown below.

Tools dnspy

Code Decompile Code Decompile

Vulnerable Application: Damn Vulnerable Thick Client App (DVTA)

Similarly, we can decompile the jar file using JD-GUI.

Buffer Overflow

A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program tries to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code.

According to OWASP

Some vulnerable applications: SLmail 5.5, Golden FTP Server 4.70, Ultra MiniHTTPd 1.2, CloudMe 1.11.2, Easy File Sharing Web Server 7.2.

You can practice on these applications. These are vulnerable to a stack-based buffer overflow.

References

About Payatu

Payatu is a Research Focused, CERT-In impaneled Cybersecurity Consulting company specializing in security assessments of IoT product ecosystem, Web application & Network with a proven track record of securing applications and infrastructure for customers across 20+ countries.


Get in touch with us. Click on the get started button below.

Get to know more about our process, methodology & team!

Close the overlay

I am looking for
Please click one!