201209241419 10ejkx
explained decrypted filler
3DES(name+title) ECB, 41 GUIDs, seed 615
From the post to its content
As posted (encrypted)
D611FEBB772BFE7D ED05B731ECBA39C3 48868560065C5DF7 16CEFF88455902C1 587372F6FB721A0E C770AF0906179BD6 BC313105D4C2A626 DBC915A9B81B67E7 D79E747AA87A649B 2A8453CDBBC3DFCE C108DFFD14FCFFEA 4DE005EE60300B30 CF3798D85E7BEECD 3203399228BF4105 CD451DA696EADD89 40A5FE9B06D81619 B9E8D360E6B7938A 5780A0A8D86E15D6 628C15DF8BB96CC4 2B6B16E95A37D489 2F02F8B6E604A5D7 1609D343D885CF1E C711A32E17359D70 C069DBA795F8B19C 7039882A19C76A60 24EE86B2D613D086 1A600433E7FF281A 284B76B52F70BCD0 33AECB41F7B8301D 6836BCCC1CEC0D03 4F95F4A3312CE675 4BA293AFA7791AA2 D484AED6ECBB1E5F 7D8830866069CB96 75DA8864B89C7B6A 06EE2005D74B586F AE5CC5CB009E9780 6493867B2CCF5794 A43CFEEA87AF3693 A2B7AE1B381DFA87 EA3D53CE29D0941B 18B20B03F418BB78 813DF561076C843F 895B53EDCBBF987E 3D5A37DFD41F80F4 51129A19917D8E97 6A6DDD18A64D1FDF 503B0E9D37C22659 078593F79E19FDAB CE8877A8D2288F57 5E3BC9C736662770 E704B595F27A3067 B3247B98741F6D22 922C231E1E73DB5F B0E550A3659D1CFF 4E1DF94819BA800D DCE1CF3826C0AC46 2307BEC8889641D7 48821883FCDB89DD F84F2722BA2AC7C9 99D167EC902C64FC 08A15F0C2323598D 8B153A87E2B5BBF9 D87E4CE0C8E25F80 317303C933F3246D 0F6549E325722D77 E89195EF8CF56C6F 7164B4071E0F7135 EC8EA179DCD5152C 7A11557CF94FAD84 2044E9A6668E62EF B002179C6D13A49E AF0339CC76550271 A558F4A4257B93C1 B10A127FBB4C18B6 E4ECCDD66F3269F3 17568A03D5099258 E2733F9B393B2476 EB2D6303E811C74D 9C45B96B41032ADC 58A76936FC576284 B5E567BF4A0F9C68 F42EAC9642265833 0165CA48216AB74F E8379956DE21F8A0 97E74B5F200482B0 31986145FBABD382 CE11A855D4B3A192 67B506B3FB160ADF 9796A50CAE2D738B 52BEF511A259D9D3 B0D640DA5B56EE8D BD72A965FC4D66EE B9CF12D89EE11B56 AED5B9386411C3A8 33B0A72CA68293DF A0A1E58EE97A7706 F4CFB267740AAEAB 02B050A0E4E19FED F8E1883374812F5E DBBEC681AB95ACD4 9C11C39B73086333 776E2B26DE37D468 2AACEF8D5E597356 A9B602E752F7779F 6BC006EA5AE55863 44812EE4BC84E9D7 ECDE30F204ABAB6A 1C710680F151F3B2 728A30E8517FB5D0 07569927DB864F56 F4E9FD9CA0FA32C0 59265E130B8E5478 1F30A413D29FAFD6 188A40E66E023070 DD3C2682C59412AF C0DDC3FDF249C2C3 C25EAA963DCACEDA 261A531B1ADFCDDD C796320250FFB98D 450F5F70BA6D6CC8 42DEEAFE2467D2B7 ED422516BAFE56D6 D92E43862DC48DA7 B0E4CE7AF2E229BC 0D06984E42C14071 B4E525EE790BAEA7 A553F98E0F09B63A 7A2322ACDA0A957D 89A45F8AFC73A87D 0AFA24FB464C6056 E87F88C4A50B70F7 2B646BD5D3366D26 A66A2665EBC9DA4F B921AFCCA2A0B6C4 AA2FE46BB30B3843 A7F725F4C99D08FA 177DC0A6F8C4421A 7B02DE32532D20CA 19EE57C85D5DF0E4 9E659851C61FD0A4 49802BFA9F01DEB9 2583BF29CF6FF49D 5A9DDB8A9CA1BDFF 8C4E0CA262EE8E3A CAED05C4E9BE3798 CFFE69F0C89F5913 0DB1A51B2F6BC74A B792BE26D2EB5FB8 F1B8E212F707122B DCCBF6EC7D926F84 3142970615E64E73 708ED30BADA81C4A 39989E208EAC52B4 7843C481B69C3D79 92EE2EB8F544C43C 55D34A05883DD3A8 CF6CA04690026292 6C35994E99553348 BA8F7B23FD43B659 49CED45686EF6310 7E31EAD43D45A591 2A1DAB9108C73831 3A7247DC9927DBC9 2E11F11AD54C89B0
- Read the ciphertext. Strip whitespace: 2,640 hex characters = 1,320 bytes = 165 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201209241419(name+title). Key = MD5(password) =47a7362c98aedc8fe274c07ad593d3d9, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 41 GUIDs as hex (shown below).
Decrypted: GUID list
1 4fe1487c-fbfd-0d1a-97c6-df8137556367 2 229a8ba4-ab2a-2365-a562-b04cabbe5c23 3 a5a87ba4-f63d-5608-94b5-ae79220db40d 4 1f346975-32aa-7902-b1f1-082287c8fd0b 5 103f88dd-ae6a-787f-847c-509a540a639e 6 1d2a59b4-2611-0e22-bdd8-d93cc148bfe0 7 15d625f5-4242-4093-8046-5319417bd1eb 8 bc1260b6-a0ed-810c-83dc-1c609dc01cd6 9 f9c30bfa-f00f-0fb8-b01e-1687c6863dbe 10 71a3f2e9-bb1b-0dfe-8979-43fd03897c68 11 f1db2808-e2b6-3c22-a2c7-6cb4a961f9f5 12 00ff8e2d-4528-523a-8e43-4977d8d09586 13 0a01cc45-42bd-3c1c-b968-f1a18c1f4a12 14 b2ec0fbd-d6e0-393d-b869-9574f6e49657 15 607d76fc-ebcc-46f6-817e-16c1e7bd7409 16 2ac277e6-af50-0b26-8aee-24c0ac260901 17 4cdb18c1-a792-37fc-a399-ac5859e2ac1a 18 8d7f94fe-edf9-2f25-95fd-2995f87122cf 19 9cf666d2-397e-24a0-9697-0253d3ea6674 20 59062431-9e90-43a4-b849-5bfd67783906 21 3528dcf9-6ebe-4042-92aa-ff5be34ae51b 22 e582a8a5-c86f-617c-bfa7-66c98ef0a397 23 45f8fbf7-7e7b-8f9f-8cf4-de2339f0c669 24 8b9b589a-d07b-7832-a446-f0c61976526e 25 30ef4cce-dab9-8a55-adb1-14a1fe00888e 26 81b64262-5201-0a3c-9c0a-0a6416891ce6 27 21f4131e-e040-6065-82b2-fc2587ae3e26 28 40d33a57-84bc-6b54-8287-e225ac29a847 29 10eb7ad0-c492-3d2b-ac2d-d61c9528d20c 30 65a3391f-8720-3ea8-b9d9-08e6abc914d3 31 4e12ff30-5655-24e9-a8d7-9a736551bf54 32 36ace0e9-6fdd-4a24-9ad8-0f3939aab5cb 33 78f9b6d2-e64c-5160-9927-67400fc71e14 34 26e4da5b-894a-3bfd-8507-9796a2a86d77 35 364b13cd-3d65-3e10-933f-90db33934789 36 d5a87fb4-7809-3f1e-8707-67695f4a18c7 37 95107211-e2ea-4ce5-9c5b-47bb82795b52 38 a4d13a3d-f849-4ec2-8dce-67e88973b369 39 e600ab60-d7c6-5fe0-b2e2-63dc65f6519f 40 4b340d1f-e90f-12d5-b0e9-f4df2b3993e4 41 eb9dc7c2-10f4-5535-884f-dbadea5c97c6
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
02577048003533403224468780663324533344515. Exactly this sequence comes out ofnew Random(615).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 244 of Run 34 (seed 83,105,000):
new Random(83105000), Next(8,64) per post. The RNG predicts N = 41; the post has N = 41 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24). - Conclusion. Filler. The content is fully explained by the two RNGs.