PT Steps

• Thick client applications are complex than others, the attack surface can be large.
• Thick client application penetration testing can be done using automated tools and manually. The following steps are usually followed when testing thick client applications.

Info Gathering

• id the app infrastructure, prog languages, frameworks, infrastructure.
• id technologies on client/server side, entry points & user inputs.
• tools:
  • |CFF Explorer|Detect It Easy|Process Monitor|Strings|

Client-side

• processing done on client side but commz with service is done
• Sensitive information like usernames and passwords, tokens, or strings for communication with other services, might be stored in the application's local files.
• hardcoded creds in app source code
• static and dynamic analysis
  • |Ghidra|IDA|OllyDbg|Radare2|dnSpy|x64dbg|JADX|Frida|

Network Side Attacks

• application is communicating with a local or remote server, network traffic analysis will help us capture sensitive information that might be transferred through HTTP/HTTPS or TCP/UDP connection, and give us a better understanding of how that application is working.
  • |Wireshark|tcpdump|TCPView|Burp Suite|

Server Side Attacks

Retrieving hardcoded Credentials from Thick-Client Applications

• scenario walks us through enum and exploitation of a thick client app to move laterally inside a corporate network.
  
• we have gained access to an SMB server.
• in a share, we see a binary - .\RestartOracle-Service.exe
• download it locally and run it. we see no output (nothing ran or something runs hidden)

NIGHTMARE - always refer to the whole page

• ProcMon
• x64dbg
• strings64
• de4dot
• DnSpy