Mail n' Trail
Honeypot-captured suspicious download activity required pulling administrative Splunk credentials out of an exposed POP3 mail server, pivoting into the SIEM, identifying malicious URLs in the log stream, and decoding a Base64 payload to close the case. Credentials were recovered through two independent methods — a PowerShell TCP client and a Telnet interactive session — to validate the finding by methodological triangulation. Splunk SPL reduced 3,000+ raw events to 56 targeted IOCs. The final Base64 payload decoded to the challenge flag.
Executive Summary
A honeypot named Cowre captured anomalous download activity at a corporate site. The investigation required retrieving Splunk access credentials from a mail server, accessing the Splunk SIEM, identifying malicious URLs in its log stream, and decoding a Base64-encoded message to reveal the final flag.
Two independent methods were used to retrieve the email containing the Splunk credentials: a PowerShell-scripted TCP client that interacted with the POP3 server programmatically, and a Telnet interactive session that spoke POP3 directly. Both methods recovered the same credentials from the same email (message #4), and the redundancy is the point — the finding is defensible because two different tooling paths converged on the identical result.
With the recovered credentials, the Splunk web interface on TCP 8000 granted access to the log stream. Custom SPL queries normalized raw log URLs into a searchable field and filtered the event set from over 3,000 raw events down to 56 targeted Pastebin indicators. One of those URLs contained a Base64 string that decoded to "Congrats, you have finished CIT_FINAL successfully" — the challenge flag. VirusTotal sanity-checks on the Pastebin indicators surfaced a phishing classification on one of the captured URLs.
Findings & Analysis
+OK Dovecot (Ubuntu) ready
(email #4 — "We launched Splunk!")
(no network restriction)
→ 56 targeted IOCs
url field, then filtered to the Pastebin domain only. The order of magnitude reduction is the investigation's analytic product, not an accident./raw/2QAuwmHe
/raw/ZTWf2ZmP
/raw/C4B5ZK8K
2QAuwmHe returned a phishing classification. The full list is recorded as IOCs for downstream blocklisting.→ "Congrats, you have
finished CIT_FINAL
successfully"
/raw/0cs1NHvh were Base64-encoded. Decoded in PowerShell to plaintext. Base64 on paste sites is a common tactic to hide payloads and flags; decoding closed the attack chain from exposure through exfiltration.- Mail server: 10.0.111.157 — TCP 110 (POP3, plaintext)
- Credentials recovered: admin / CTF_Final! (email #4)
- Splunk host: 10.0.111.157 — TCP 8000 (no network restriction)
- Pastebin IOCs: /raw/0cs1NHvh, /raw/2QAuwmHe, /raw/ZTWf2ZmP, /raw/C4B5ZK8K
- Phishing classification (VT): /raw/2QAuwmHe
- Decoded flag: "Congrats, you have finished CIT_FINAL successfully"
- MITRE ATT&CK: T1071.001 (Application Layer Protocol — Web Protocols), T1071.003 (Application Layer Protocol — Mail Protocols)
Tools & Technologies
System.Net.Sockets.TcpClient used to speak POP3 programmatically when interactive Telnet was unavailable. Scripted, logged, reproducible — the approach of choice when the environment has PowerShell but not Telnet.USER, PASS, LIST, RETR n, QUIT. The quickest path when Telnet is installed and human-in-the-loop inspection is acceptable. Telnet was not present by default on the Windows Server image; enabled via dism.rex field extraction, URL normalization, and domain filtering. The query is the analytic artifact — it's what turned an unreadable log stream into a set of four actionable indicators.Method — Dual-Path Validation
Two independent methods recovered the same credentials from the same email. Both are documented in full below. This is not redundancy for its own sake — the value of a credential recovery finding is only as strong as the confidence that the recovery is real, and two different tooling paths converging on the identical result closes the confidence gap that a single successful command leaves open.
A single successful Telnet session could be environmental luck — wrong account enabled by default, pre-authenticated session, tooling artifact. A single successful PowerShell TCP client could be a quirk of how StreamReader happened to handle the banner response. When both methods return the same credentials on the same message, neither explanation survives. The finding is confirmed by methodological triangulation, not by any one tool. That matters in a report a downstream reviewer will read: it turns an assertion into evidence.
Quickest path when Telnet is installed. Direct, human-readable command exchange over TCP 110. Preferred when interactive inspection of the mailbox is acceptable and a scripted log is not required.
Why: The challenge spec placed the mail server at local IP + 1. Confirming the local IPv4 first is what makes the next step's target IP correct rather than guessed.
Why: Route and reachability check before any service-level work. If ping fails, the lab network is misconfigured or the target IP assumption is wrong — catching that now is cheaper than diagnosing it through a failed Telnet.
Why: Telnet ships with Windows Server but is disabled by default. Enabling it through dism avoids the longer Server Manager path and requires admin PowerShell. Documented because downstream reviewers need to know Telnet was not pre-installed.
Why: POP3 on TCP 110 is plaintext and accepts simple line-based commands. The +OK Dovecot banner confirms the service is running and identifies the server software — useful context if something downstream behaves unexpectedly.
Why: Standard POP3 authentication followed by LIST to enumerate mailbox contents. Four messages returned, sized 1117 / 1361 / 1210 / 869 bytes.
Why: Fetch each message in sequence and inspect content for credential-like material. Emails #1–#3 were operational notifications (maintenance, monitoring, software update). Email #4 — subject "We launched Splunk!" — contained username: admin and password: CTF_Final! in plaintext, along with the Splunk URL http://[SERVER-IP]:8000/.
Why: Direct validation of the recovered credentials against the target service. Successful login confirms the email contents were not stale — these are live administrative credentials on an exposed Splunk instance.
Why: index=* with a URL-substring filter catches any event that mentions a URL or download command. rex extracts those URLs into a named url field so they can be ranked and filtered. Narrowing to *pastebin.com* drops the noise — the reduction from 3,000+ raw events to 56 Pastebin-specific events is the analytic product of the search, and the path that got there is visible in the query itself.
Why: Independent reputation signal on every captured URL. VirusTotal flagged 2QAuwmHe as phishing; the remaining three were not flagged by any engine. The phishing classification was not on the flag-bearing URL, which underlines the point — reputation data complements analysis, it does not replace it.
Why: Base64 on paste sites is a standard payload-hiding technique. Decoding is the closing move on the attack chain — from exposure (open POP3) through credential recovery, SIEM pivot, IOC isolation, and finally the hidden content itself.
Used when Telnet is not installed or when a scripted, logged, reproducible trace is required. Interacts with the POP3 service at the socket level through System.Net.Sockets.TcpClient.
Why: Same rationale as Method A — the target IP is derived from the local IP. Different lab session, different IPs; same protocol.
Why: Reachability check before service-level work.
Why: Enumerate the common mail and shell ports in one loop to establish the attack surface before committing to an approach. POP3 (110) confirmed open; SMTP (25) and POP3S (995) also responded; IMAP (143, 993) closed. Choice of POP3 over IMAP is dictated by what's actually open.
Why: TcpClient speaks raw TCP, which is all POP3 is. StreamWriter.Flush() on every line matters — without it, PowerShell's buffering silently holds commands and the server receives nothing. ReadLine() after each write synchronizes on the server response. Explicit, scripted, and reproducible — the exact opposite of Telnet's interactive convenience.
Why: POP3 terminates a multi-line response with a bare period on its own line. Reading until . is the correct termination — reading a fixed byte count would truncate, and reading to end-of-stream would hang waiting for the server to close the socket. Same credentials surfaced as Method A: admin / CTF_Final!. The dual-path validation is complete.
Why: In this lab session, the Splunk host's exact IP wasn't stated up front — only that it was in the subnet. Port-8000 sweep across the relevant range locates it without requiring DNS or broadcast reconnaissance. -WarningAction SilentlyContinue suppresses the noise from each failed connection attempt.
Why: The SPL pattern is stable across both methods. Minor variation — stats count by url instead of table — gives a ranked indicator list rather than a time-ordered stream, useful when prioritizing for blocklisting. Decoded the same Base64 payload from /raw/0cs1NHvh to recover the identical flag. Chain closed independently of Method A.
Recommendations
Technical Note
The investigation's central analytic move is the reduction from 3,000+ raw events to 56 Pastebin-specific events. That reduction is the SPL query itself. It's not a filter applied to a display — it is the data transformation that produced the finding. Two components do the work: a rex extraction that lifts URLs out of unstructured _raw into a named field, and a wildcard search that narrows by domain. Neither is sophisticated individually. Together they are the difference between an unreadable log stream and a list of four IOCs ready for downstream action.
The query generalizes. Any investigation involving URLs embedded in log text can apply the same pattern: regex-extract into a named field, filter by the domain class of interest, surface what's left. Downstream investigators reading the SPL should be able to retarget it to a different domain or indicator class with a single-line change. That portability is part of what SPL authoring — as distinct from SPL running — actually produces.
Methodological redundancy with Telnet and PowerShell served a different purpose: defending the credential recovery against the possibility of tooling artifact. Both are characteristic of the case type. One investigation asked "what are the indicators?" and answered through SPL. A parallel part of the same investigation asked "are these really the credentials?" and answered through independent re-derivation. Both questions got explicit, documented answers.
References
- MITRE ATT&CK — Application Layer Protocol. T1071.001 (Web Protocols) and T1071.003 (Mail Protocols) map to the Pastebin command-and-control pattern and the POP3 credential exfiltration surface observed in this case. attack.mitre.org/techniques/T1071
- Splunk Search Reference. Official SPL documentation for
rex,search, andstats— the core commands used to author the filter that produced the IOC list. docs.splunk.com - VirusTotal. Multi-engine URL reputation source used to supplement the Splunk-derived IOCs. virustotal.com
- Microsoft — POP3 Protocol reference. Canonical reference for POP3 commands (
USER,PASS,LIST,RETR,QUIT) and response framing, including the multi-line dot-terminator used inRETRresponses. learn.microsoft.com