Reversing & Decrypting Database Credentials using Damn Vulnerable Thick Client App
Background
In the previous article, we have discussed injection attacks in Thick Client Applications specifically in DVTA. In this article, we will discuss how to decompile .NET applications to abuse the vulnerabilities exposed through the source code. To better understand this article, it is recommended to read the previous parts of this series if you haven't done yet.
FREE role-guided training plans
Let's begin.
There are multiple tools available for decompiling .NET applications. We are going to use dotPeek in this article. dotPeek can be downloaded from the following URL.
https://www.jetbrains.com/decompiler/download/
Launch dotPeek after downloading it. It should look as shown in the figure below.
dotPeek comes handy when you need to decompile the .NET assemblies into its equivalent c# source code. dotPeek has various other features apart from what we need in this article. You may explore its features from the following URL if you are interested.
https://www.jetbrains.com/decompiler/features/
Let us proceed to decompile DVTA application and explore if there is anything of our interest. dotPeek supports individual files as well as complete folders with .NET assemblies. Let us load individual files by navigating to File | Open. This looks as shown in the figure below.
Choose DVTA.exe file from DVTA application as shown in the figure below.
This will load DVTA.exe into Assembly Explorer as shown in the following figure.
If we click on any of the files shown under DVTA, dotPeek shows the decompiled code automatically as shown in the following figure.
IN DVTA, most of the database related code is written in DBAccess.dll. So, let us decompile DBAccess.dll using the same steps we used with DVTA.exe. Load DBAccess.dll and then choose DBAccessClass as shown in the figure below.
This will produce the code from DBAccessClass.cs file as shown in the figure below.
If you closely observe the above piece of code, there is a function called decryptPassword() inside which, the encrypted database password is being decrypted.
This logic is useful to write a new application that can decrypt the Database password in the same way as DVTA is decrypting it. In PART-1 of this series, we observed a configuration file inside DVTA directory, where we found encrypted database password, AES Key, and IV as shown in the figure below.
Now that we have the following details:
Encrypted Text: CTsvjZ0jQghXYWbSRcPxpQ==
AES KEY: J8gLXc454o5tW2HEF7HahcXPufj9v8k8
IV: fq20T0gMnXa6g0l4
Let us create a new application in C# using Visual Studio and decrypt the password using the information available.
-
Launch Visual Studio and create a new Windows Forms Application. In our case, it is named as aesdecrypt.
-
Now, add a button to the form as shown in the figure below.
- Double click the above button, and we will land in .cs file where the code has to be written.
-
Make sure that you add the crypto reference System.Security.Cryptography as shown in the figure below.
-
As shown in the following figure, change the method name to decrypt for the button click event and write the code.
As you can see in the above figure, we used the same code taken from the decompiled code with some minor modifications. The original code takes the inputs from the configuration file, and they are hardcoded here. We are printing the decrypted password to the console using Console.WriteLine(). So, the decrypted password should be seen after running the application and clicking the button.
- Finally, run the application and click decrypt button.
-
Now, check Visual Studio output console and the following should be seen.
Nice, we have decrypted the password. We can use this decrypted password to login to the database as shown in PART-3 of this series.
Following is the complete source code we used in the above example.
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Security.Cryptography;
namespace aesdecrypt
{
public partial class aesdecrypt : Form
{
public aesdecrypt()
{
InitializeComponent();
}
private void decrypt(object sender, EventArgs e)
{
String key = "J8gLXc454o5tW2HEF7HahcXPufj9v8k8";
String IV = "fq20T0gMnXa6g0l4";
String encryptedtext = "CTsvjZ0jQghXYWbSRcPxpQ==";
byte[] encryptedBytes = Convert.FromBase64String(encryptedtext);
AesCryptoServiceProvider aes = new AesCryptoServiceProvider();
aes.BlockSize = 128;
aes.KeySize = 256;
aes.Key = System.Text.ASCIIEncoding.ASCII.GetBytes(key);
aes.IV = System.Text.ASCIIEncoding.ASCII.GetBytes(IV);
aes.Padding = PaddingMode.PKCS7;
aes.Mode = CipherMode.CBC;
ICryptoTransform crypto = aes.CreateDecryptor(aes.Key, aes.IV);
byte[] decryptedbytes = crypto.TransformFinalBlock(encryptedBytes, 0, encryptedBytes.Length);
String decryptedString = System.Text.ASCIIEncoding.ASCII.GetString(decryptedbytes);
Console.WriteLine("n");
Console.WriteLine("##########Decryptig Database password##########n");
Console.WriteLine("Decrypted Database password:" + decryptedString+"n");
Console.WriteLine("##########Done##########n");
}
}
What should you learn next?
}
Conclusion
In this article, we have discussed how .NET applications can be Reverse Engineered using dotPeek to view the source code and proceed further with the security assessment. We have also discussed how one can write his/her own application to decrypt the database credentials of DVTA using the decryption logic exposed in the application's source code. In the next article, we will discuss how to patch .NET applications to modify the application's logic.
In this Series
- Reversing & Decrypting Database Credentials using Damn Vulnerable Thick Client App
- Intelligence-led pentesting and the evolution of Red Team operations
- Red Teaming: Taking advantage of Certify to attack AD networks
- How ethical hacking and pentesting is changing in 2022
- Ransomware penetration testing: Verifying your ransomware readiness
- Red Teaming: Main tools for wireless penetration tests
- Fundamentals of IoT firmware reverse engineering
- Red Teaming: Top tools and gadgets for physical assessments
- Red teaming: Initial access and foothold
- Top tools for red teaming
- What is penetration testing, anyway?
- Red Teaming: Persistence Techniques
- Red Teaming: Credential dumping techniques
- Top 6 bug bounty programs for cybersecurity professionals
- Tunneling and port forwarding tools used during red teaming assessments
- SigintOS: Signal Intelligence via a single graphical interface
- Top tools for mobile android assessments
- Top tools for mobile iOS assessments
- Red Team: C2 frameworks for pentesting
- Inside 1,602 pentests: Common vulnerabilities, findings and fixes
- Red teaming tutorial: Active directory pentesting approach and tools
- Red Team tutorial: A walkthrough on memory injection techniques
- Python for active defense: Monitoring
- Python for active defense: Network
- Python for active defense: Decoys
- How to write a port scanner in Python in 5 minutes: Example and walkthrough
- Using Python for MITRE ATT&CK and data encrypted for impact
- Explore Python for MITRE ATT&CK exfiltration and non-application layer protocol
- Explore Python for MITRE ATT&CK command-and-control
- Explore Python for MITRE ATT&CK email collection and clipboard data
- Explore Python for MITRE ATT&CK lateral movement and remote services
- Explore Python for MITRE ATT&CK account and directory discovery
- Explore Python for MITRE ATT&CK credential access and network sniffing
- Top 10 security tools for bug bounty hunters
- Kali Linux: Top 5 tools for password attacks
- Kali Linux: Top 5 tools for post exploitation
- Kali Linux: Top 5 tools for database security assessments
- Kali Linux: Top 5 tools for information gathering
- Kali Linux: Top 5 tools for sniffing and spoofing
- Kali Linux: Top 8 tools for wireless attacks
- Kali Linux: Top 5 tools for penetration testing reporting
- Kali Linux overview: 14 uses for digital forensics and pentesting
- Top 19 Kali Linux tools for vulnerability assessments
- Explore Python for MITRE ATT&CK persistence
- Explore Python for MITRE ATT&CK defense evasion
- Explore Python for MITRE ATT&CK privilege escalation
- Explore Python for MITRE ATT&CK initial access
- Top 18 tools for vulnerability exploitation in Kali Linux
- Explore Python for MITRE PRE-ATT&CK, network scanning and Scapy
- Kali Linux: Top 5 tools for social engineering
- Basic snort rules syntax and usage [updated 2021]
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, (ISC)², Cisco, Microsoft and more!
Penetration testing
Intelligence-led pentesting and the evolution of Red Team operations
Penetration testing
Red Teaming: Taking advantage of Certify to attack AD networks
Penetration testing
Penetration testing
Ransomware penetration testing: Verifying your ransomware readiness