performing-thick-client-application-penetration-test

厚客户端应用程序渗透测试

概述

厚客户端（胖客户端）渗透测试用于评估在用户计算机本地运行并与后端服务器通信的桌面应用程序的安全性。与 Web 应用程序不同，厚客户端的攻击面更广，涵盖本地文件存储、二进制分析、内存操控、DLL 注入、进程拦截以及客户端与服务器之间的通信。常见目标包括银行应用程序、ERP 客户端（SAP GUI）、交易平台、医疗系统和旧版企业软件。

适用场景

• 开展涉及厚客户端应用程序渗透测试的安全评估时
• 按照相关安全事件的事件响应流程处理时
• 执行定期安全测试或审计活动时
• 通过实践测试验证安全控制时

前提条件

• 应用程序安装程序和有效凭据
• Windows/Linux 测试计算机（隔离环境）
• 工具：dnSpy、Procmon、Process Hacker、Wireshark、Burp Suite、Echo Mirage、Fiddler、IDA Pro/Ghidra
• 测试计算机的管理员权限

**法律声明：**此技能仅用于授权的安全测试和教育目的。未经授权对你不拥有或未获得书面测试许可的系统进行测试属于违法行为，可能违反计算机欺诈相关法律。

阶段 1 — 信息收集

静态分析

# Identify application technology
# Check file properties, signatures, framework (.NET, Java, C++, Electron)
file application.exe
# .NET -> dnSpy, JetBrains dotPeek
# Java -> JD-GUI, JADX
# C/C++ -> Ghidra, IDA Pro
# Electron -> extract asar archive

# Check for .NET framework
Get-ChildItem -Path "C:\Program Files\TargetApp" -Recurse -Filter "*.dll" |
  ForEach-Object { [System.Reflection.AssemblyName]::GetAssemblyName($_.FullName).FullName }

# Strings analysis
strings application.exe | findstr -i "password\|secret\|api\|key\|token\|jdbc\|connection"

# Check for hardcoded credentials
strings application.exe | findstr -i "username\|user=\|pass=\|pwd=\|admin"

# Review configuration files
type "C:\Program Files\TargetApp\app.config"
type "C:\Program Files\TargetApp\settings.xml"
type "%APPDATA%\TargetApp\config.json"

# Check for certificate pinning
strings application.exe | findstr -i "cert\|pin\|ssl\|tls"

使用 dnSpy 进行 .NET 反编译

# Open application in dnSpy
1. Launch dnSpy
2. File > Open > Select application.exe and DLLs
3. Search for:
   - "password", "secret", "connectionString"
   - Authentication methods
   - Encryption/decryption functions
   - API endpoints and keys
   - License validation logic

# Look for:
- Hardcoded credentials in source
- Insecure encryption (DES, MD5, base64 "encryption")
- SQL queries (potential injection)
- Disabled certificate validation
- Debug/verbose logging with sensitive data

阶段 2 — 动态分析

进程监控

# Monitor file system activity with Procmon
# Filters:
#   Process Name = application.exe
#   Operation = CreateFile, WriteFile, ReadFile, RegSetValue

# Key observations:
# - Where does the app store data? (AppData, temp, registry)
# - Does it write credentials to disk?
# - Does it create temporary files with sensitive data?
# - What registry keys does it access?

# Monitor with Process Hacker
# Check: loaded DLLs, network connections, handles, tokens

# Monitor network traffic
# Wireshark filter: ip.addr == <server_ip>
# Check for: unencrypted credentials, API keys, tokens

流量拦截

# Intercept HTTP/HTTPS traffic with Burp Suite
# Configure system proxy: 127.0.0.1:8080
# Install Burp CA certificate in Windows certificate store

# For non-HTTP protocols, use Echo Mirage
# Inject into process and intercept TCP/UDP traffic

# For HTTPS with certificate pinning:
# Method 1: Patch certificate validation in dnSpy
# Method 2: Use Frida to hook SSL validation
frida -l bypass_ssl_pinning.js -f application.exe

# Fiddler for .NET applications
# Enable HTTPS decryption
# Monitor API calls, request/response bodies

阶段 3 — 漏洞测试

身份验证绕过

# Test local authentication bypass
1. Open dnSpy, find authentication method
2. Set breakpoint on credential validation
3. Modify return value to bypass (Debug > Set Next Statement)
4. Or: Patch binary to always return true

# Test for credential storage
# Check: registry, config files, SQLite databases, Windows Credential Manager
reg query "HKCU\Software\TargetApp" /s
type "%APPDATA%\TargetApp\user.db"
# SQLite: sqlite3 user.db ".dump"

DLL 劫持

# Identify DLL search order vulnerability
# Use Procmon to find DLLs loaded from writable paths
# Filter: Result = NAME NOT FOUND, Path ends with .dll

# Create malicious DLL
# msfvenom -p windows/exec CMD=calc.exe -f dll -o hijacked.dll
# Place in application directory or writable PATH directory

# DLL sideloading
# If app loads DLL without full path:
# 1. Create DLL with same exports
# 2. Place in app directory
# 3. DLL loads before legitimate version

内存分析

# Dump process memory
# Use Process Hacker > Process > Properties > Memory
# Search for plaintext credentials, tokens, session IDs

# Strings from memory dump
strings process_dump.dmp | findstr -i "password\|token\|session\|bearer"

# Modify memory values (license bypass, privilege escalation)
# Use Cheat Engine or x64dbg to:
# 1. Find memory address of authorization variable
# 2. Modify value (e.g., isAdmin = 0 -> isAdmin = 1)

输入验证

# SQL Injection in local database
# Test input fields with: ' OR 1=1--
# If app uses local SQLite/SQL Server Express

# Command injection
# Test fields that interact with OS:
# File paths: ..\..\..\..\windows\system32\cmd.exe
# Print/export: | calc.exe

# Buffer overflow
# Send oversized input to text fields
# Monitor with x64dbg for crashes
# Check for SEH-based or stack-based overflows

阶段 4 — API 安全测试

# Capture API calls from thick client
# In Burp Suite, analyze:

# IDOR (Insecure Direct Object Reference)
# Change user IDs in requests to access other users' data
# GET /api/users/1001 -> GET /api/users/1002

# Authorization bypass
# Remove or modify JWT tokens
# Test role escalation: change role claim from "user" to "admin"

# Mass assignment
# Add additional parameters to API requests
# POST /api/profile {"name": "test", "isAdmin": true}

# Rate limiting
# Test for brute-force protection on login API
# Test for account lockout bypass

发现问题模板

发现问题	严重性	CVSS	修复措施
二进制文件中硬编码数据库凭据	严重	9.1	使用安全的凭据存储方式（DPAPI、保管库）
通过可写应用程序目录进行 DLL 劫持	高	7.8	使用完整 DLL 路径，验证 DLL 签名
内存中存在明文凭据	高	7.5	使用后清除内存，使用 SecureString
未实施证书固定	中	6.5	实施证书固定
本地 SQLite 数据库中存储明文密码	严重	9.0	使用 bcrypt/Argon2 哈希
代码中禁用了 SSL 验证	高	8.1	启用正确的证书验证

参考资料

• dnSpy：https://github.com/dnSpy/dnSpy
• Procmon：https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
• OWASP 厚客户端测试指南：https://owasp.org/www-project-thick-client-top-10/
• Ghidra：https://ghidra-sre.org/
• Echo Mirage：https://sourceforge.net/projects/echomirage/