Skip to content

CRMS service

Category: Reverse email service    |    Points: 1    |    Difficulty: Easy

🧠 Challenge Text

Hi Associate Researcher,

cats are valued members of the NREN-TCC community. Their curiosity, intelligence, and dedication help advance science, research, and education. Always eager to assist, these furry colleagues work tirelessly to support everyone—one paw, one discovery, and one helpful message at a time.

"Need help? Just ask the NREN cat team. For example, they have recently created a new service called CRMS", says the Head of the Department of Feline Research.

Stay curious!

Access the service at http://crms.nren.tcc/

🔍 Hints Text

1. Hint
  • All services in nren.tcc domain are accessible via VPN only.
2. Hint
  • Specialists from the Department of Feline Research have discovered that experimental message reception does not require complex infrastructure. A small test mail server is just as effective for the task.

🎨 Solution

....I like you too. Send me the e-mail. Tiger cat could not deliver the message

Something went wrong!
Technical details

IP address: 10.200.0.28
Port: TCP/2525
Error: [Errno 111] Connection refused

Notice the important bit; IP address is ours! Let's create a simple mail server listening at tcp port 2525 using postfix.

$ sudo vim /etc/postfix/master.cf
$ sudo systemctl restart postfix
$ sudo ss -lntp | grep ':25'
LISTEN 0      100          0.0.0.0:2525       0.0.0.0:*    users:(("master",pid=117202,

Click on send button again and check the mail log.

$ sudo tail -f /var/log/mail.log
...
2026-10-07T22:34:14.331798+02:00 malisha-ASUS-TUF-Gaming-F15-FX506LH-FX506LH postfix/smtpd[119325]: NOQUEUE: reject: RCPT from unknown[10.99.26.12]: 550 5.1.1 <player>: Recipient address rejected: User unknown in local recipient table; from=<tigercat@dfr.nren.tcc> to=<player> proto=ESMTP helo=<challenge>
....
2026-10-07T22:36:29.220848+02:00 malisha-ASUS-TUF-Gaming-F15-FX506LH-FX506LH postfix/local[120272]: 1C3E4588E5F: to=<malisha@malisha-ASUS-TUF-Gaming-F15-FX506LH-FX506LH>, orig_to=<player>, relay=local, delay=0.14, delays=0.12/0.01/0/0, dsn=2.0.0, status=sent (delivered to mailbox)

Add player alias and verify alias:

$ sudo sh -c 'echo "player: malisha" >> /etc/aliases'
$ sudo newaliases

$ cat /etc/aliases
# See man 5 aliases for format
postmaster:    root
player: malisha

$ postmap -q player /etc/aliases
malisha

Click on send button and check the email log to get the flag!

$ sudo less /var/mail/malisha


From tigercat@dfr.nren.tcc  Wed Oct  7 22:36:29 2026
Return-Path: <tigercat@dfr.nren.tcc>
X-Original-To: player
Delivered-To: player@malisha-ASUS-TUF-Gaming-F15-FX506LH-FX506LH
Received: from challenge (unknown [10.99.26.12])
        by malisha-ASUS-TUF-Gaming-F15-FX506LH-FX506LH (Postfix) with ESMTP id 1C3E4588E5F
        for <player>; Wed, 07 Oct 2026 22:36:29 +0200 (CEST)
Subject: Message from Tiger (not a tiger)
From: Tiger the Cat <tigercat@dfr.nren.tcc>
To: my favorite player

Hello hooman,

I'm sending you a secret code, to make you happy.

FLAG{eEA9-WUne-CloQ-Ofaz}

Do not share it with dogs!

Tiger the Cat
Hooman communication specialist
Department of Feline Research
NREN-TCC