Thick Client Applications — Discovery & Enumeration

Thick client applications are locally installed software that perform significant processing on the client side. They present a large attack surface including hardcoded credentials, local data storage, and client-to-server communications that may be unencrypted or improperly validated.

Identifying Thick Client Applications

On User Workstations

Common locations:

C:\Program Files\
C:\Program Files (x86)\
C:\Users\[username]\AppData\Local\
C:\Users\[username]\AppData\Roaming\
C:\Users\[username]\Desktop\
%ProgramData%\

Identify via:

# List installed programs
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | 
  Select-Object DisplayName, InstallLocation

# Find executables
dir C:\Program Files\ -Filter *.exe -Recurse

# Check for custom applications
dir C:\Users\[username]\AppData\ -Filter *.exe -Recurse

On Network Shares

Thick client applications are often deployed via:

\\server\netlogon\           # NETLOGON share
\\server\sysvol\             # SYSVOL share
\\server\apps\               # Application share
\\server\deployments\        # Deployment share

Discovery:

# SMB enumeration
smbmap -H target.com -u user -p password
net view \\target.com\

# Mount and browse shares
mount -t cifs \\target.com\netlogon /mnt/share -o user=username,password=password
ls -la /mnt/share/

Enumeration Methodology

Step 1: Identify Application Type

File signature analysis:

# Check file type
file application.exe
# Output: EXE, PE 32/64-bit executable

# Read PE headers
CFF Explorer application.exe
# Look for: .NET assemblies, imports, resources

# Identify framework
strings application.exe | grep -i ".net\|java\|framework"

Common application types:

Step 2: Extract Metadata

Binary metadata:

# Get file information
file application.exe
exiftool application.exe
wmic datafile where name="C:\\path\\application.exe" get Description,Version

# Read embedded strings
strings application.exe | head -50
strings -e l application.exe  # Unicode strings

# Look for important information
strings application.exe | grep -i "version\|copyright\|product"

Version detection:

# Get file version from properties
[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\path\application.exe")

# Check version info
(Get-Item C:\path\application.exe).VersionInfo

Step 3: Identify Dependencies

Understand what the application needs:

# Analyze PE imports
CFF Explorer application.exe → Imports section

# Check DLL dependencies
dumpbin /imports application.exe
objdump -x application.exe

# Monitor in Process Monitor
procmon.exe → Filter for application.exe

Look for:

• Database drivers (ODBC, MySQL, PostgreSQL, SQL Server)
• Web service libraries (HTTP, SOAP, REST)
• Cryptography libraries (OpenSSL, BoringSSL)
• Authentication libraries (LDAP, Kerberos)

Step 4: Static Analysis for Entry Points

Identify user-controlled inputs:

# Decompile .NET application
dnspy application.exe
# Look for: Form_Load, button_Click, textBox_TextChanged events

# Analyze C/C++ binary
ida application.exe
# Search for: strcpy, sprintf, scanf functions

# Java analysis
jd-gui application.jar
# Look for: ActionListener, KeyListener, input handlers

Common entry points:

• Text input fields
• File upload dialogs
• Network request handlers
• Configuration file parsers
• Command execution functions

Step 5: Identify Backend Communications

Analyze network behavior:

# Monitor network connections
netstat -ano | findstr "application.exe"
tcpview.exe

# Capture traffic
wireshark → Filter by application.exe process
netsh trace start capture=yes

# Check for hardcoded URLs
strings application.exe | grep -E "http://|https://|\.com|\.local"

Look for:

• Server hostnames/IPs
• Port numbers
• API endpoints
• Database connection strings
• Service URLs

Step 6: Check Configuration Files

Applications often store settings locally:

application.exe.config       # .NET configuration
app.properties               # Java properties
config.ini, config.xml       # Generic config
settings.json                # JSON configuration
Registry keys (Windows)      # HKEY_LOCAL_MACHINE\Software\...

Parse configuration files:

# .NET config file
cat application.exe.config | grep -i "connectionstring\|password"

# Java properties
grep -i "password\|username\|host" application.properties

# Registry dump
reg export HKLM\Software\Company\Application config.reg
cat config.reg | findstr "password"

Common Vulnerability Patterns

Hardcoded Credentials

Search in decompiled code:

// .NET examples
private string password = "P@ssw0rd123";
string connString = "Server=db.local;User=sa;Password=hardcoded";

// Java examples
String apiKey = "sk-1234567890abcdef";
String dbPassword = "mysql_root_password";

Unencrypted Communications

Identify during traffic analysis:

HTTP (not HTTPS) communications
Plain FTP (not SFTP)
Telnet connections
Unencrypted database connections (port 3306, 5432)

DLL Hijacking Vulnerabilities

Check DLL loading order:

# Monitor DLL loading
procmon.exe → Filter for "Load Image"
# Look for: NAME NOT FOUND status → potential hijack point

# Check application directory
dir "C:\Program Files\Application\" | findstr ".dll"
# If writable by user → potential hijack

Insecure Storage

Check file system:

# Look for credentials in files
dir C:\Users\[username]\AppData\Local\Application\ -R
grep -r "password" C:\Users\[username]\AppData\Local\

# Check for cache files
dir C:\Users\[username]\AppData\Local\Temp\
ls -la ~/.cache/application/

Information Gathering Checklist

• Locate the application executable(s)
• Identify application framework (.NET, Java, C++, etc.)
• Extract version information
• Review file properties and metadata
• Identify all dependencies (DLLs, libraries)
• Find configuration files
• Identify backend server(s) and databases
• Check for hardcoded credentials in strings
• Analyze network communication patterns
• Review file system permissions
• Check registry entries (Windows)
• Identify update/installation mechanisms
• Look for debug/logging capabilities

Tools Checklist

Static Analysis:

• CFF Explorer (PE analysis)
• Detect It Easy (binary type detection)
• Strings (text extraction)
• dnSpy (.NET decompilation)
• jd-gui (Java decompilation)
• IDA or Ghidra (disassembly)

Dynamic Analysis:

• Process Monitor (SysInternals)
• Process Explorer (SysInternals)
• TCPView (connection monitoring)
• Wireshark (packet capture)

Network Analysis:

• Burp Suite (HTTP interception)
• Fiddler (HTTP proxy)
• tcpdump (packet capture)

Next Steps

Once enumeration is complete:

1. If hardcoded credentials found → Attempt lateral movement using discovered credentials
2. If unencrypted communications → Set up MITM attack via ARP spoofing or network configuration
3. If DLL hijacking possible → Create malicious DLL for code execution
4. If custom server found → Perform web application penetration testing on backend
5. If insecure storage found → Extract and decrypt stored data
6. If authentication weak → Attempt credential brute-forcing or session hijacking