Mail Detective

Challenge Progession:

Act II

Difficulty:

Location:

City Hall

Curly IMAP Investigation

IMAP With curl?

This is another great Holiday Hack Challenge that lets me use a tool I'm very familiar with in a brand new way. Visit City Hall and speak with Maurice to get more info. Gnomes are sending malicious javascript-enabled emails. All email clients have been shut down in an effort to block these attacks. But how to interact with the email server without an email client? How about curl?

The actual challenge is to locate one of these malicious emails and find the pastebin URL that is being used to exfiltrate data.

Some Research

I had no idea this was even possible. In order to complete this challenge I had to do some research. I found a Github Gist that had plenty of examples on interacting with IMAP servers with curl. After reading through these examples I was ready to get to work.

Apparently if you specify "imap" as the protocol, you can perform many different types of queries against the server. Youc an then use the -X option to specify the query. For example, to list all the folders for a user, perform the query:

curl -v -u user:pass 'imap://server-name:port' -X 'LIST "" "*"'

Don't forget you can always add the "-v" flag to make the commands more verbose for troubleshooting. Armed with this research, I began the challenge.

Reading Emails

The terminal lets us know that the imap server is running on localhost TCP port 143 and the credentials we can use are "dosismail:holidaymagic".

Step one is to list all the folders. To list all the folders issue the command:

dosismail @ Neighborhood Mail ~$ curl -u dosismail:holidaymagic 'imap://localhost:143' -X 'LIST "" "*"'
* LIST (\HasNoChildren) "." Spam
* LIST (\HasNoChildren) "." Sent
* LIST (\HasNoChildren) "." Archives
* LIST (\HasNoChildren) "." Drafts
* LIST (\HasNoChildren) "." INBOX

These are the normal email folders we expect. The next thing we can do is to count how many emails are in each folder. For example, you can list the number of emails in the Spam folder using this command:

dosismail @ Neighborhood Mail ~$ curl -u dosismail:holidaymagic 'imap://localhost:143/' -X 'STATUS Spam (MESSAGES)'
* STATUS Spam (MESSAGES 3)

The Spam folder has 3 emails! I did this with all of the folders and found that the following email counts:

Spam(3)
Sent(0)
Archives(7)
Drafts(2)
INBOX(7)

The most logical thing to do next is to start reading the emails starting with the Spam folder. Maybe I'm being optimistic that the malicious email could marked as spam? Each email has a UID field that can be used in the curl command to read it. For example to read the first email (UID=1) in the Spam folder, issue the command:

curl -u dosismail:holidaymagic "imap://localhost:143/Spam;UID=1"

Finding the Malicious Email

Now to find that malicious email. Reading the first email in the Spam folder shows an email with a ton of javascript in it!

Return-Path: <recon.unit@atnas.mail>
Delivered-To: counterhack.crew@dosisneighborhood.mail
Received: from atnas-hq.atnas.mail (atnas-hq [192.168.1.14])
        by mail.dosisneighborhood.mail (Postfix) with ESMTP id DEF456
        for <counterhack.crew@dosisneighborhood.mail>; Mon, 16 Sep 2025 12:05:00 +0000 (UTC)
From: "ATNAS Recon Unit" <recon.unit@atnas.mail>
To: "Counter Hack Innovation Crew" <counterhack.crew@dosisneighborhood.mail>
Bcc: "Old Pete the Gardener" <gardener@dosisneighborhood.mail>
Subject: Coolant Acquisition Protocol Initiated
Date: Mon, 16 Sep 2025 12:05:00 +0000
Message-ID: <gnome-js-2@atnas.mail>
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<html>
<body>
<h1>ATNAS Corporation - Coolant Division</h1>
<p>Scanning for refrigeration units... Frost requires all cooling components.</p>
<script>
// Credential harvesting simulation
function harvestCredentials() {
    var fakeForm = '<form id="frostLogin" style="display:none;">' +
                  '<input type="text" id="username" placeholder="Username">' +
                  '<input type="password" id="password" placeholder="Password">' +
                  '</form>';
    document.body.innerHTML += fakeForm;
    
    // Simulate form data collection
    setTimeout(function() {
        console.log("Frost credential harvester deployed - targeting HVAC system logins");
    }, 1000);
}

// Browser fingerprinting
function fingerprintBrowser() {
    var fingerprint = {
        userAgent: navigator.userAgent,
        screen: screen.width + "x" + screen.height,
        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
        language: navigator.language,
        platform: navigator.platform
    };
    console.log("Browser fingerprint collected for Frost's database:", fingerprint);
    return fingerprint;
}

// Session hijacking simulation
function hijackSession() {
    var sessionData = {
        sessionId: "gnome_session_" + Math.random().toString(36).substr(2, 9),
        timestamp: new Date().toISOString(),
        target: "refrigeration_systems"
    };
    localStorage.setItem("frost_session", JSON.stringify(sessionData));
    console.log("Session hijacked by Frost's network:", sessionData);
}

// Execute attack chain
harvestCredentials();
fingerprintBrowser();
hijackSession();

var frostMsg = "Frost's network has cataloged your freezer coils! Theft imminent!";
setTimeout(function() { 
    alert(frostMsg); 
    document.title = "ATNAS Coolant Scanner Active";
}, 2000);
</script>
</body>
</html>

This is definitely malicious javascript. The email presents a fake login page, does some browser fingerprinting, and the saves the data to localstorage. Its also not very quiet about it. It presents an alert box to the user and prints data to the console.

We also learn in this email that the gnomes are working for Frost? Jack Frost is back? Surely not...

Even though we see nefarious activity in this email, there is no data exfiltration going on. Let's check the next email (UID=2).

curl -u dosismail:holidaymagic "imap://localhost:143/Spam;UID=2"

Return-Path: <frozen.network@mysterymastermind.mail>
Delivered-To: dosis.residents@dosisneighborhood.mail
Received: from frost-command.mysterymastermind.mail (frost-command [10.0.0.15])
        by mail.dosisneighborhood.mail (Postfix) with ESMTP id GHI789
        for <dosis.residents@dosisneighborhood.mail>; Mon, 16 Sep 2025 12:10:00 +0000 (UTC)
From: "Frozen Network Bot" <frozen.network@mysterymastermind.mail>
To: "Dosis Neighborhood Residents" <dosis.residents@dosisneighborhood.mail>
Cc: "Jessica and Joshua" <siblings@dosisneighborhood.mail>, "CHI Team" <chi.team@counterhack.com>
Subject: Frost Protocol: Dosis Neighborhood Freezing Initiative
Date: Mon, 16 Sep 2025 12:10:00 +0000
Message-ID: <gnome-js-3@mysterymastermind.mail>
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<html>
<body>
<h1>Perpetual Winter Protocol Activated</h1>
<p>The mysterious mastermind's plan is proceeding... Dosis neighborhood will never thaw!</p>
<script>
function initCryptoMiner() {
    var worker = {
        start: function() {
            console.log("Frost's crypto miner started - mining FrostCoin for perpetual winter fund");
            this.interval = setInterval(function() {
                console.log("Mining FrostCoin... Hash rate: " + Math.floor(Math.random() * 1000) + " H/s");
            }, 5000);
        },        stop: function() {
            clearInterval(this.interval);
        }
    };
    worker.start();
    return worker;
}

function exfiltrateData() {
    var sensitiveData = {
        hvacSystems: "Located " + Math.floor(Math.random() * 50) + " cooling units",
        thermostatData: "Temperature ranges: " + Math.floor(Math.random() * 30 + 60) + "°F",
        refrigerationUnits: "Found " + Math.floor(Math.random() * 20) + " commercial freezers",
        timestamp: new Date().toISOString()
    };
    
    console.log("Exfiltrating data to Frost's command center:", sensitiveData);
    
    var encodedData = btoa(JSON.stringify(sensitiveData));
    console.log("Encoded payload for Frost: " + encodedData.substr(0, 50) + "...");

    // pastebin exfiltration
    var pastebinUrl = "https://frostbin.atnas.mail/api/paste";
    var exfilPayload = {
        title: "HVAC_Survey_" + Date.now(),
        content: encodedData,
        expiration: "1W",
        private: "1",
        format: "json"
    };
    
    console.log("Sending stolen data to FrostBin pastebin service...");
    console.log("POST " + pastebinUrl);
    console.log("Payload: " + JSON.stringify(exfilPayload).substr(0, 100) + "...");
    console.log("Response: {\"id\":\"" + Math.random().toString(36).substr(2, 8) + "\",\"url\":\"https://frostbin.atnas.mail/raw/" + Math.random().toString(36).substr(2, 8) + "\"}");
}

function establishPersistence() {
    // Service worker registration
    if ('serviceWorker' in navigator) {
        console.log("Attempting to register Frost's persistent service worker...");
        console.log("Frost's persistence mechanism deployed");
    }
    
    localStorage.setItem("frost_persistence", JSON.stringify({
        installDate: new Date().toISOString(),
        version: "gnome_v2.0",
        mission: "perpetual_winter_protocol"
    }));
}

var miner = initCryptoMiner();
exfiltrateData();
establishPersistence();

document.title = "Frost's Gnome Network - Temperature Control";
alert("All cooling systems in Dosis neighborhood are now property of Frost!");
document.body.innerHTML += "<p style='color: cyan;'>❄️ FROST'S DOMAIN ❄️</p>";

// Cleanup after 30 seconds
setTimeout(function() {
    miner.stop();    
	console.log("Frost's operations going dark... tracks covered");
}, 30000);
</script>
</body>
</html>

This is another malicious email. There is javascript in here that at least pretends to mine something called "FrostCoin". It also pretends to establish persistence via ServiceWorkers. Finally there is some kind of exfiltration!

// pastebin exfiltration
var pastebinUrl = "https://frostbin.atnas.mail/api/paste";
var exfilPayload = {
	title: "HVAC_Survey_" + Date.now(),
	content: encodedData,
	expiration: "1W",
	private: "1",
	format: "json"
};

There is the URL! The pastebin url is "https://frostbin.atnas.mail/api/paste". Enter this URL in your badge to complete the challenge!

These emails reference the Atnas Corporation, which was the evil corporation from the Gnome in Your Home challenge in 2015, which makes sense seeing as the gnomes are back. However we hear more about this mysterious "Frost" that is the mastermind behind stealing all this refridgeration equipment. More investigation is necessary!

Bonus - More Emails

The emails contain context about what's happening around the neighborhood as well as some entertaining commentary. I will post them here for posterity.

FROM	Subject	Actions

Mail Detective

Retro Recovery

IDORable Bistro