Disclose_The_Agent

Scenario

We reached the data of an agent leaking information. You have to disclose the agent.

Executive Summary

A single capture holds a cleartext SMTP submission from a laptop to AOL’s mail relay on port 587. The sender authenticated with AUTH LOGIN, which only base64-encodes the username and password, so both are readable straight from the stream. The message went to a second AOL mailbox and carried a Word document as an attachment. Decoding the MIME body rebuilt the document byte for byte, and an image embedded in it gave away the meeting location. No decryption was needed at any point, because STARTTLS was never used.

Artifacts

• smtpchallenge.pcap: smtpchallenge.pcap → open with tshark or Wireshark. One SMTP submission, TCP stream 1, from 192.168.1.159 to 64.12.102.142:587

Timestamp note: No question asks for a time. The SMTP banner and the message Date: header disagree on timezone (-0400 versus -0600), so don’t build a timeline from them.

Credential Access

The capture holds one SMTP session (TCP stream 1) and it is plaintext, and the server offers AUTH LOGIN without ever negotiating STARTTLS. After AUTH LOGIN the server sends two base64 prompts (Username: and Password:), and the client answers each with a base64 string. Decode the second client line. Follow the stream to see the dialogue, then decode.

tshark -r smtpchallenge.pcap -q -z follow,tcp,ascii,1

echo NTU4cjAwbHo= | base64 -d

Gotcha: The format hint is eight characters, and the base64 string is longer. The line that follows 334 UGFzc3dvcmQ6 is the password, not the username line above it.

Collection

List the conversations first to find the one SMTP session, then follow that stream. The client sends MAIL FROM for the sender’s AOL address, then RCPT TO for the recipient. The To: header in the message body names the same mailbox, and the subject line is rendezvous, which settles who the message was meant for.

tshark -r smtpchallenge.pcap -q -z conv,tcp

tshark -r smtpchallenge.pcap -q -z follow,tcp,ascii,1 | grep -aE '^(MAIL FROM|RCPT TO|To:|Subject:)'

Further down the same stream, the MIME body is multipart/mixed. The second part carries a Content-Disposition: attachment header with the filename= parameter, and its body is a base64 blob.

grep -a -A2 'Content-Disposition: attachment' s1.txt

The message text says the address is attached and tells the recipient to bring a passport and a bathing suit, so the answer lives inside the document. A .docx is a zip: unpack it and open the images under word/media. image1.png is a map of Playa del Carmen, which places the meeting in the country the answer names. This one needs a human look at the picture, since no text in the document states it.

unzip -o sr.docx -d dx

Strip the MIME headers from the attachment part, base64-decode the body into a file, and hash it. The decoded file unzips cleanly as a Word document, which confirms the carve is intact.

base64 -d attachment.b64 > sr.docx && md5sum sr.docx

Tip: Hash the decoded bytes, not the base64 text. Hashing the encoded blob gives a different value.

Attack Summary

Phase	Action
Credential Access	Mailbox credentials sent in cleartext over SMTP AUTH LOGIN on port 587
Collection	Message with subject rendezvous sent to a second AOL mailbox
Exfiltration	Word document attached to the message, base64 in the MIME body
Collection	Embedded map image in the document reveals the meeting country

IOCs

Type	Value
Sender mailbox	sneakyg33k@aol[.]com
Recipient mailbox	mistersecretx@aol[.]com
Password (cleartext)	558r00lz
SMTP server	64.12.102[.]142:587
Client	192.168.1.159 (annlaptop)
File	secretrendezvous.docx
MD5	9e423e11db88f01bbff81172839e1923

MITRE ATT&CK

Technique	ID	Description
Network Sniffing	T1040	Credentials and message content readable from the capture
Exfiltration Over Unencrypted Non-C2 Protocol	T1048.003	Document sent over plaintext SMTP
Email Collection: Remote Email Collection	T1114.003	Message and attachment recovered from the SMTP stream

Defender Takeaways

Block cleartext SMTP authentication. The server offered AUTH LOGIN before any TLS, and the client used it. Require STARTTLS (or implicit TLS on 465) before AUTH is advertised, and the credentials never cross the wire readable.

AUTH LOGIN is encoding, not protection. Base64 decodes in one command, so a capture of this session hands over the mailbox password. Alert on outbound port 587 or 25 sessions without a TLS upgrade.

Outbound mail with attachments to external consumer mailboxes is a data-loss channel. A DLP rule on attachments sent to free mail providers would have flagged this message. The attachment rebuilt perfectly from the capture, so full-packet capture is enough to reproduce a leaked file.

Conclusion

One unencrypted SMTP session gave away the sender’s password, the recipient, the attached file and, through an image inside it, the meeting country. Nothing was hidden; the only barrier was base64, and TLS was never in the way.