> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/binary-analysis/information-gathering.md).

# Information Gathering

the following tools will help us gather information in binaries:

| [CFF Explorer](https://ntcore.com/?page_id=388) | [Detect It Easy](https://github.com/horsicq/Detect-It-Easy) | [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | [Strings](https://learn.microsoft.com/en-us/sysinternals/downloads/strings) |
| ----------------------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
|                                                 |                                                             |                                                                                     |                                                                             |

<details>

<summary>Process monitor</summary>

### Example scenario - Process Monitor

he following scenario walks us through enumerating and exploiting a thick client application, in order to move laterally inside a corporative network during penetration testing. The scenario starts after we have gained access to an exposed SMB service.

Exploring the `NETLOGON` share of the SMB service reveals `RestartOracle-Service.exe` among other files. Downloading the executable locally and running it through the command line, it seems like it does not run or it runs something hidden.

Attacking Thick Client Applications

```cmd-session
C:\Apps>.\Restart-OracleService.exe
C:\Apps>
```

Downloading the tool `ProcMon64` from [SysInternals](https://learn.microsoft.com/en-gb/sysinternals/downloads/procmon) and monitoring the process reveals that the executable indeed creates a temp file in `C:\Users\Matt\AppData\Local\Temp`.

![File operation logs showing 'Restart-OracleService' with actions: CloseFile, CreateFile, and CloseFile, all successful.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/113/thick_clients/procmon.png)

In order to capture the files, it is required to change the permissions of the `Temp` folder to disallow file deletions. To do this, we right-click the folder `C:\Users\Matt\AppData\Local\Temp` and under `Properties` -> `Security` -> `Advanced` -> `cybervaca` -> `Disable inheritance` -> `Convert inherited permissions into explicit permissions on this object` -> `Edit` -> `Show advanced permissions`, we deselect the `Delete subfolders and files`, and `Delete` checkboxes.

![Permission entry dialog for 'Temp' folder. Principal: Matt. Type: Allow. Applies to: This folder, subfolders, and files. Advanced permissions include full control, read, write, and change permissions.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/113/thick_clients/change-perms.png)

Finally, we click `OK` -> `Apply` -> `OK` -> `OK` on the open windows. Once the folder permissions have been applied we simply run again the `Restart-OracleService.exe` and check the `temp` folder. The file `6F39.bat` is created under the `C:\Users\cybervaca\AppData\Local\Temp\2`. The names of the generated files are random every time the service is running.

</details>

```bash
#getting type of file 
file binary
```

### &#x20;