🚩 HTB Sherlock - Phishing_Email

Executive Summary

• Scenario: Your email address has been leaked and you receive an email from Paypal in German. Try to analyze the suspicious email. Connect to the VM with the credential provided using RDP.

xfreerdp3 /v:<ipaddress> /u:letsdefend /p:'' /cert:ignore /dynamic-resolution

File location: C:\Users\LetsDefend\Desktop\Files\PhishingChallenge.zip Password: infected

• Status: Completed

---

Collection

The challenge gave us only an .eml file to analyze. An .eml file a single email message saved as a plain text file. It contains:

• Header: Details like the sender, recipient, subject line, and date or time.
• Body: The main text or HTML content and hyperlinks.
• Attachments: Any files or images sent with the email, saved inside the file.

Examination

No preprocessing needed: an .eml is plain text, so the headers and body can be read directly (or rendered by opening it in the VM’s mail client).

Analysis - Questions

What is the return path of the email?

If we open the .eml file using double click, Windows will realize that this is an email file and uses the default file to open it, in this case, the VM set the default application to Thunderbird:

However, this is not the full content of the .eml file, many information has been obscured by the client application, which we can ready easily using the terminal or any text editors. Here in the VM, the terminal is our only way to read the raw content.

type Desktop\Files\paypal.eml

The Return-Path of an email is a hidden technical address that receives automated bounce notifications and delivery failure reports when a message cannot be delivered. To find its header, we can just press Ctrl + F then find string Return-Path and the answer should soon reveals

Answer: bounce@rjttznyzjjzydnillquh.designclub.uk.com

Note: Each new server touches the mail add its header to the top of the .eml file. Each of these new headers added starts with a Received: header, which contains the address of the previous the server. Therefore, the further up the a header is, the more trustworthy the information that header contains. This is because the attacker would have to compromise the whole chain of servers in order to fake everything.

Here the Return-Path header sits right inside the third hop, so there is a low chance that the malicious actor has control over this header. The Return-Path header is also something that was copied from the Received-SPF: header right below, that’s the check from mx.google.com which can possibly be compromised by the attacker.

The bounce email address belongs to randomly generated subdomain name, which is already a suspicious sign.

What is the domain name of the URL in this mail?

There are multiple URL embedded inside the emails as hyperlinks, all of them leads to the URL https://storage.googleapis.com/hqyoqzatqthj/aemmfcylvxeo.html#QORHNZC44FT4.QORHNZC44FT4?dYCTywccxr3jcxxrmcdcKBdmc5D6qfcJVcbbb4M. The domain of the URL is right after the scheme https://

Answer: storage.googleapis.com

Is the domain mentioned in the previous question suspicious?

The question is phrased in a weird way. To be fair, the domain of the previous question is not suspicious, Google is Google after all. However, considering the nature of a phishing email, it is probably a payment portal, or a login portal that mimic one of Paypal. Therefore, what’s suspicious about this email, is the fact that Paypal is asking us to interact with it on a page hosted at a third party service.

Answer: yes

What is the sender IP address listed in the Received-SPF header?

SPF is an abbreviation for Sender Policy Framework, it works by the domain owner publishes a public list of IP addresses allowed to send mail to their domain. The receiver literally just check if the mail came from an allowed domain. The Received-SPF: header is the server recording the result of that SPF check, including the IP address that connected.

Answer: 134.195.196.43

Is this email a phishing email?

To answer this question, we have to take into account several other elements that wasn’t discovered by the questions.

On the first line of the second hop (the Received: header), we can see that foresthillrestaurant.com was supposed to be the domain of the previous hop, however, Google did a reverse DNS lookup upon the IP address of the sender and it was capchrist.org, which was a completely different domain. So the sender is not what he claimed to be.

Next up is the Received: line of the first hop. since this is bottom of the header list, it is the least trustworthy. Moreover, this Received: header is a lot different from that same header that comes from other hop server. It has no by, no for and no timestamp.

If we translate the message into English:

The message is very suspicious, especially if the recipient does not remember any of this information, or if they go online and see no information about such event officially from PayPal. So the obvious answer to this question is…

Answer: yes

---

References: Link