INTERNAL MEMO CHAIN

Challenge Description

Subject: Re: Re: Re: Re: Re: Budget Reallocation - Pigeon Fleet Expansion vs. Actual Satellites

A single .eml file, eleven replies deep. The subject line alone is a warning about what's inside.

The Wrong Approach: Opening in a Mail Client

Mail clients render .eml files beautifully. They display the latest message at the top, collapse the quoted thread below, and hide anything that isn't body text. Headers are tucked away behind a "show details" dropdown that shows From, To, Date, Subject, and maybe Message-ID.

X-Agency-Ref is a custom header. No mail client will surface it by default. If you're reading this in Outlook or Thunderbird, you're reading the wrong thing.

The Right Approach: Raw Source

cat INTERNAL_MEMO_CHAIN.eml | grep 'X-Agency-Ref'

Or open it in any text editor and search for X-Agency-Ref.

Structure of the .eml

The file is a standard RFC 2822 message. The newest email (Email 1 of 12) is at the top with full outer headers. Each older email is quoted below it in standard --- Original Message --- format, with its own mini-header block including X-Agency-Ref.

From: Director <director@deadrop.internal>
To: ...
Date: Mon, 5 Sep 1983 08:00:00 -0700
Subject: Re: Re: Re: Re: ...
Message-ID: <DR-1983-001@deadrop.internal>
X-Agency-Ref: REVBR              ← newest email (Email 1)
X-Classification: SECRET

[body of newest email]

--- Original Message ---
From: Dr. H. Marsh <h.marsh@deadrop.internal>
...
X-Agency-Ref: FJPUH              ← Email 2

> [quoted body]

--- Original Message ---
...
X-Agency-Ref: tlbWF              ← Email 3

...and so on down to Email 12

Twelve emails, twelve X-Agency-Ref headers.

Extracting and Ordering

grep 'X-Agency-Ref' INTERNAL_MEMO_CHAIN.eml

Output (in file order, newest first):

X-Agency-Ref: ob3Jyb3J9
X-Agency-Ref: RpY19
X-Agency-Ref: WNyYX
X-Agency-Ref: cmVhd
X-Agency-Ref: kX2J1
X-Agency-Ref: NfYW5
X-Agency-Ref: nNpY3
X-Agency-Ref: b3Jlb
X-Agency-Ref: pbF9m
X-Agency-Ref: tlbWF
X-Agency-Ref: FJPUH
X-Agency-Ref: REVBR

The headers appear newest-first in the file (the outer email is first, the deepest quote is last), but the flag is encoded oldest-first.

Reverse the order:

REVBR FJPUH tlbWF pbF9m b3Jlb nNpY3 NfYW5 kX2J1 cmVhd WNyYX RpY19 ob3Jyb3J9

Concatenate:

REVBRFJPUHtlbWFpbF9mb3JlbnNpY3NfYW5kX2J1cmVhdWNyYXRpY19ob3Jyb3J9

Use your favorite base64 decoder:

DEADROP{email_forensics_and_bureaucratic_horror}

Python One-Liner

import re, base64

raw = open('INTERNAL_MEMO_CHAIN.eml').read()
frags = re.findall(r'X-Agency-Ref: (.+)', raw)
flag = base64.b64decode(''.join(reversed(frags))).decode()
print(flag)

Key Takeaways

1. Mail clients hide headers. Custom X-* headers are invisible in rendered email views. Any mail-based forensics challenge requires looking at the raw RFC 2822 source, the stuff mail clients actively hide from you.

2. Quoted email chains are a data layer cake. Each reply wraps the previous one. A twelve-email thread has twelve header blocks in one file, only one of which is the "real" outer header. The rest are embedded in the quoted body text, which most parsers treat as plain text.

3. Ordering matters with encoding. The fragments are base64 chunks that only decode correctly when assembled in the right order. The file order (newest-first) is the reverse of the fragment order (oldest-first). Getting the direction wrong produces garbage that looks almost like valid base64, which is the exact kind of wrong that wastes ten minutes in a time based CTF.

4. The content is worth reading. The pigeon fleet vs. satellite budget thread is twelve emails of increasingly unhinged bureaucratic horror that culminates in the Director approving $400 for "discretion" to a contractor whose name must not appear in documentation. His name is Gerald. It is now in the minutes.

Flag

DEADROP{email_forensics_and_bureaucratic_horror}