Game Invitation - HackTheBox Challenge Writeup

Challenge Information

Description

In the bustling city of KORP™, factions vie in an intense competition called The Fray. A mysterious new game emerges, and as a faction member, you receive an intriguing email: “Join The Fray: Embrace the Challenge.” However, suspicion creeps in—the innocent-looking attachment may harbor something sinister. Your task is to investigate the email and its attachment to uncover what malicious content lies beneath the surface.

Challenge Context

This forensics challenge requires analyzing email artifacts and potentially embedded files to reveal hidden threats. The scenario emphasizes the importance of not trusting attachments at face value, a critical lesson in cybersecurity awareness.

Solution Approach

The investigation centers on forensic analysis of the provided email attachment. Key areas to examine include:

• Email Headers: Metadata that reveals sender information, routing details, and authenticity indicators
• Email Body Content: Text and HTML components that may contain encoded or hidden data
• Attachments: Binary analysis of any files attached to the email
• Embedded Objects: Images, scripts, or other content embedded within the email structure

Key Steps

Step 1: Extract and Examine the Email File

Begin by extracting the email artifact and identifying its format:

# List challenge files
ls -la

# Examine email file structure
file email_attachment.eml
# or
file email_attachment.msg

Step 2: Parse Email Headers and Metadata

Extract critical metadata from the email:

# For EML files, view raw headers
cat email_attachment.eml | head -50

# Extract specific header information
grep -i "from:\|to:\|subject:\|date:" email_attachment.eml

Step 3: Analyze Email Body and Encoding

Check for encoded content, HTML, or suspicious elements:

# Search for base64 encoded content
grep -i "base64\|Content-Transfer-Encoding" email_attachment.eml

# Extract and decode base64 sections
cat email_attachment.eml | grep -A 50 "base64" | base64 -d > extracted_file

Step 4: Examine Embedded Attachments

Extract any files embedded within the email:

# Use specialized email parsing tools
python3 << 'EOF'
import email
from email import policy

with open('email_attachment.eml', 'rb') as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

    # List all parts
    for i, part in enumerate(msg.walk()):
        print(f"Part {i}: {part.get_content_type()}")
        if part.get_filename():
            print(f"  Filename: {part.get_filename()}")
            # Extract attachment
            with open(part.get_filename(), 'wb') as out:
                out.write(part.get_payload(decode=True))
EOF

Step 5: Binary Analysis of Extracted Files

Analyze any extracted files for hidden content:

# Identify file type
file extracted_file

# Hexdump for inspection
hexdump -C extracted_file | head -20

# Search for strings
strings extracted_file | grep -i "flag\|htb\|korp"

Tools Used

• Standard Unix Tools: cat, grep, file, strings, hexdump, base64
• Python: Email parsing libraries (email, email.policy)
• Specialized Forensics Tools: Depending on artifact complexity
  • exiftool - For metadata extraction
  • binwalk - For embedded file detection
  • steghide - For steganographic content

Key Learnings

1. Never Trust Attachments Blindly: Even innocent-looking email attachments can contain malicious or hidden content. Always analyze the complete structure.

2. Email Forensics Fundamentals: Understanding email encoding (MIME, base64, quoted-printable) is essential for analyzing email artifacts.

3. Metadata Analysis: Email headers and file metadata often reveal crucial information about origin, routing, and authenticity.

4. Layered Content: Attackers frequently use multiple layers of encoding or embedding to hide malicious content. Systematic analysis of each layer is necessary.

5. KORP™ Lore: This challenge reinforces the narrative that threats in The Fray may come through unexpected channels, requiring constant vigilance.

Flag: HTB{<redacted>}