#!/usr/bin/env python3
# For authorized penetration testing and educational environments only.
# Usage against targets without prior mutual consent is illegal.
# It is the end user's responsibility to obey all applicable local, state and federal laws.
"""Agent for thick client application penetration testing.

Performs static analysis (strings extraction, .NET detection),
dynamic analysis (process monitoring, DLL search order checks),
local storage auditing, and API traffic interception assessment.
"""

import json
import sys
import os
import re
import sqlite3
from pathlib import Path
from datetime import datetime

_SAFE_TABLE_RE = re.compile(r'^[a-zA-Z_][a-zA-Z0-9_]*$')


class ThickClientPentestAgent:
    """Performs security assessment of thick/fat client applications."""

    def __init__(self, app_path, output_dir="./thick_client_pentest"):
        self.app_path = Path(app_path)
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)
        self.findings = []

    def extract_strings(self, min_length=6):
        """Extract readable strings from binary for credential/URL discovery."""
        patterns = {
            "url": re.compile(r'https?://[^\s"\'<>]{5,200}'),
            "email": re.compile(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'),
            "ip_addr": re.compile(r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'),
            "password_hint": re.compile(
                r'(?i)(password|passwd|pwd|secret|api.?key|token|'
                r'connectionstring|jdbc|bearer)', re.IGNORECASE),
            "sql_query": re.compile(r'(?i)(SELECT|INSERT|UPDATE|DELETE)\s+', re.IGNORECASE),
        }
        results = {k: [] for k in patterns}
        try:
            with open(self.app_path, "rb") as f:
                data = f.read()
            text = data.decode("ascii", errors="ignore")
            for name, pattern in patterns.items():
                matches = pattern.findall(text)
                results[name] = list(set(matches))[:50]

            if results["password_hint"]:
                self.findings.append({
                    "type": "Credential Reference in Binary",
                    "severity": "Medium",
                    "details": f"Found {len(results['password_hint'])} credential-related strings",
                })
            if results["sql_query"]:
                self.findings.append({
                    "type": "SQL Queries in Binary",
                    "severity": "Medium",
                    "details": "Embedded SQL may be vulnerable to injection",
                })
        except (OSError, PermissionError) as exc:
            results["error"] = str(exc)
        return results

    def detect_framework(self):
        """Detect the application framework (.NET, Java, Electron, C++)."""
        try:
            with open(self.app_path, "rb") as f:
                header = f.read(4096)

            if b"BSJB" in header or b".NET" in header or b"mscorlib" in header:
                return {"framework": ".NET", "decompiler": "dnSpy / ILSpy"}
            if b"PK" in header[:4]:
                return {"framework": "Java (JAR)", "decompiler": "JD-GUI / JADX"}
            if b"asar" in header or b"electron" in header:
                return {"framework": "Electron", "tool": "asar extract"}
            return {"framework": "Native (C/C++)", "decompiler": "Ghidra / IDA Pro"}
        except OSError as exc:
            return {"error": str(exc)}

    def check_local_storage(self, app_name=None):
        """Scan common local storage locations for sensitive data."""
        app_name = app_name or self.app_path.stem
        locations = []
        appdata = os.environ.get("APPDATA", "")
        localappdata = os.environ.get("LOCALAPPDATA", "")

        search_dirs = [
            Path(appdata) / app_name if appdata else None,
            Path(localappdata) / app_name if localappdata else None,
            self.app_path.parent,
        ]
        sensitive_exts = {".db", ".sqlite", ".sqlite3", ".json", ".xml",
                         ".config", ".ini", ".cfg", ".log"}

        for search_dir in search_dirs:
            if search_dir is None or not search_dir.exists():
                continue
            for root, dirs, files in os.walk(search_dir):
                for fname in files:
                    fpath = Path(root) / fname
                    if fpath.suffix.lower() in sensitive_exts:
                        size = fpath.stat().st_size
                        locations.append({
                            "path": str(fpath), "type": fpath.suffix,
                            "size_bytes": size,
                        })

        if locations:
            self.findings.append({
                "type": "Sensitive Local Files",
                "severity": "Medium",
                "details": f"Found {len(locations)} potentially sensitive files",
            })
        return locations

    def audit_sqlite_databases(self, db_paths):
        """Check local SQLite databases for plaintext credentials."""
        results = []
        for db_path in db_paths:
            try:
                conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True)
                cursor = conn.cursor()
                cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
                tables = [r[0] for r in cursor.fetchall()]

                sensitive_tables = []
                for table in tables:
                    lower = table.lower()
                    if any(kw in lower for kw in
                           ["user", "account", "credential", "auth",
                            "login", "password", "token", "session"]):
                        if not _SAFE_TABLE_RE.match(table):
                            continue
                        cursor.execute(f"SELECT COUNT(*) FROM [{table}]")
                        count = cursor.fetchone()[0]
                        sensitive_tables.append({"table": table, "rows": count})

                if sensitive_tables:
                    self.findings.append({
                        "type": "Sensitive SQLite Database",
                        "severity": "High",
                        "details": f"{db_path}: {sensitive_tables}",
                    })
                results.append({"database": db_path, "tables": tables,
                                "sensitive_tables": sensitive_tables})
                conn.close()
            except sqlite3.Error as exc:
                results.append({"database": db_path, "error": str(exc)})
        return results

    def check_dll_hijack_paths(self):
        """Check for DLL hijacking via writable directories in PATH."""
        writable_dirs = []
        path_dirs = os.environ.get("PATH", "").split(os.pathsep)
        for d in path_dirs:
            if os.path.isdir(d) and os.access(d, os.W_OK):
                writable_dirs.append(d)

        app_dir = str(self.app_path.parent)
        app_dir_writable = os.access(app_dir, os.W_OK)

        if writable_dirs or app_dir_writable:
            self.findings.append({
                "type": "DLL Hijacking Risk",
                "severity": "High",
                "details": f"Writable PATH dirs: {len(writable_dirs)}, "
                           f"App dir writable: {app_dir_writable}",
            })
        return {"writable_path_dirs": writable_dirs,
                "app_dir_writable": app_dir_writable}

    def generate_report(self):
        """Generate comprehensive pentest findings report."""
        report = {
            "target": str(self.app_path),
            "report_date": datetime.utcnow().isoformat(),
            "framework": self.detect_framework(),
            "total_findings": len(self.findings),
            "critical": sum(1 for f in self.findings if f["severity"] == "Critical"),
            "high": sum(1 for f in self.findings if f["severity"] == "High"),
            "medium": sum(1 for f in self.findings if f["severity"] == "Medium"),
            "findings": self.findings,
        }
        report_path = self.output_dir / "thick_client_report.json"
        with open(report_path, "w") as f:
            json.dump(report, f, indent=2)
        print(json.dumps(report, indent=2))
        return report


def main():
    if len(sys.argv) < 2:
        print("Usage: agent.py <application.exe> [output_dir]")
        sys.exit(1)
    app_path = sys.argv[1]
    output_dir = sys.argv[2] if len(sys.argv) > 2 else "./thick_client_pentest"
    agent = ThickClientPentestAgent(app_path, output_dir)
    agent.extract_strings()
    agent.check_local_storage()
    agent.check_dll_hijack_paths()
    agent.generate_report()


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Thick Client Penetration Test — Static Analysis Helper

Performs basic static analysis on thick client applications: string extraction,
config file scanning, and DLL dependency analysis.

Usage:
    python process.py --app-dir "C:/Program Files/TargetApp" --output ./results
"""

import os
import re
import json
import argparse
import datetime
from pathlib import Path


SENSITIVE_PATTERNS = {
    "password": re.compile(r'(?i)(password|passwd|pwd)\s*[=:]\s*["\']?([^\s"\']+)'),
    "api_key": re.compile(r'(?i)(api[_-]?key|apikey)\s*[=:]\s*["\']?([^\s"\']+)'),
    "connection_string": re.compile(r'(?i)(connection[_-]?string|jdbc:)\s*[=:]\s*["\']?([^\s"\']+)'),
    "secret": re.compile(r'(?i)(secret|token)\s*[=:]\s*["\']?([^\s"\']+)'),
    "url_with_creds": re.compile(r'https?://[^:]+:[^@]+@[\w.]+'),
    "hardcoded_ip": re.compile(r'\b(?:10|172\.(?:1[6-9]|2\d|3[01])|192\.168)\.\d{1,3}\.\d{1,3}\b'),
}


def extract_strings(filepath: str, min_length: int = 8) -> list[str]:
    """Extract printable strings from a binary file."""
    strings = []
    try:
        with open(filepath, "rb") as f:
            data = f.read()

        current = []
        for byte in data:
            if 32 <= byte <= 126:
                current.append(chr(byte))
            else:
                if len(current) >= min_length:
                    strings.append("".join(current))
                current = []
        if len(current) >= min_length:
            strings.append("".join(current))
    except (PermissionError, OSError):
        pass
    return strings


def scan_for_secrets(strings: list[str]) -> list[dict]:
    """Scan extracted strings for sensitive patterns."""
    findings = []
    for s in strings:
        for name, pattern in SENSITIVE_PATTERNS.items():
            match = pattern.search(s)
            if match:
                findings.append({
                    "type": name,
                    "match": s[:200],
                    "severity": "High" if name in ("password", "connection_string", "secret") else "Medium"
                })
                break
    return findings


def scan_config_files(app_dir: str) -> list[dict]:
    """Scan configuration files for sensitive data."""
    config_extensions = {".config", ".xml", ".json", ".ini", ".properties", ".yaml", ".yml", ".cfg"}
    findings = []

    for root, dirs, files in os.walk(app_dir):
        for filename in files:
            ext = os.path.splitext(filename)[1].lower()
            if ext in config_extensions:
                filepath = os.path.join(root, filename)
                try:
                    with open(filepath, encoding="utf-8", errors="ignore") as f:
                        content = f.read()
                    for name, pattern in SENSITIVE_PATTERNS.items():
                        matches = pattern.findall(content)
                        for match in matches:
                            findings.append({
                                "file": filepath,
                                "type": name,
                                "match": str(match)[:200],
                                "severity": "High"
                            })
                except (PermissionError, OSError):
                    continue
    return findings


def analyze_dlls(app_dir: str) -> list[dict]:
    """Analyze DLL dependencies for potential hijacking."""
    dlls = []
    for root, dirs, files in os.walk(app_dir):
        for filename in files:
            if filename.lower().endswith(".dll"):
                filepath = os.path.join(root, filename)
                dlls.append({
                    "name": filename,
                    "path": filepath,
                    "writable": os.access(filepath, os.W_OK),
                    "size": os.path.getsize(filepath)
                })

    writable = [d for d in dlls if d["writable"]]
    return dlls, writable


def generate_report(app_dir: str, string_findings: list[dict],
                     config_findings: list[dict], dll_info: tuple,
                     output_dir: Path) -> str:
    """Generate thick client analysis report."""
    report_file = output_dir / "thick_client_report.md"
    timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
    all_dlls, writable_dlls = dll_info

    with open(report_file, "w") as f:
        f.write("# Thick Client Static Analysis Report\n\n")
        f.write(f"**Application:** {app_dir}\n")
        f.write(f"**Generated:** {timestamp}\n\n---\n\n")

        f.write("## Binary String Analysis\n\n")
        if string_findings:
            f.write(f"Found **{len(string_findings)}** potentially sensitive strings:\n\n")
            f.write("| Type | Match | Severity |\n|------|-------|----------|\n")
            for finding in string_findings[:50]:
                f.write(f"| {finding['type']} | `{finding['match'][:80]}` | {finding['severity']} |\n")
        else:
            f.write("No sensitive strings detected in binaries.\n")
        f.write("\n")

        f.write("## Configuration File Analysis\n\n")
        if config_findings:
            f.write(f"Found **{len(config_findings)}** sensitive entries in configs:\n\n")
            for finding in config_findings[:20]:
                f.write(f"- **{finding['type']}** in `{finding['file']}`: `{finding['match'][:80]}`\n")
        else:
            f.write("No sensitive data found in configuration files.\n")
        f.write("\n")

        f.write("## DLL Analysis\n\n")
        f.write(f"Total DLLs: **{len(all_dlls)}**\n")
        f.write(f"Writable DLLs (potential hijacking): **{len(writable_dlls)}**\n\n")
        if writable_dlls:
            f.write("| DLL | Path |\n|-----|------|\n")
            for dll in writable_dlls:
                f.write(f"| {dll['name']} | {dll['path']} |\n")
        f.write("\n")

    print(f"[+] Report: {report_file}")
    return str(report_file)


def main():
    parser = argparse.ArgumentParser(description="Thick Client Static Analysis")
    parser.add_argument("--app-dir", required=True, help="Application installation directory")
    parser.add_argument("--output", default="./results")
    args = parser.parse_args()

    output_dir = Path(args.output)
    output_dir.mkdir(parents=True, exist_ok=True)

    print(f"[*] Scanning {args.app_dir}...")

    # Scan binaries for strings
    all_findings = []
    for root, dirs, files in os.walk(args.app_dir):
        for filename in files:
            if filename.lower().endswith((".exe", ".dll")):
                filepath = os.path.join(root, filename)
                strings = extract_strings(filepath)
                findings = scan_for_secrets(strings)
                all_findings.extend(findings)

    # Scan config files
    config_findings = scan_config_files(args.app_dir)

    # Analyze DLLs
    dll_info = analyze_dlls(args.app_dir)

    generate_report(args.app_dir, all_findings, config_findings, dll_info, output_dir)
    print("[+] Analysis complete")


if __name__ == "__main__":
    main()