201210041102 10xsbd
explained decrypted filler
3DES(name+title) ECB, 39 GUIDs, seed 385
From the post to its content
As posted (encrypted)
B01F60FBC122CF0C 701D8FEB9EFD0C35 3E805B335FB7DC0C ED6FDBAC7EA3EE75 4BB8D03C3489E29B EFA42E2704697A94 E5EEDCECA1EB3820 83CBF132C125B193 842AF27C33C02ECC 103F61B4D759544C 79B5DE37C9EF896F EDF8008EBE3D095E 57ED5673E596108C C62AEA199F4ABE3E 435B1FD1BE48404A 4BA61E65B09C7482 1B5D238A127C81AD 9990FFC928C7D7A6 12045106B86FE006 36C60AB950BC6A3C DEED83D2C3E6DA9B 497807FEF34EC0E8 8982480E93A48809 748DBDB356B95808 D9F8BFB38B5AA98D 01BC433BEC0F4E2B 00E9CDCF7E06CEE7 2F3241976A5CC028 AA255A314C44594B 0E249023AFB5FD57 F47AB025D5723816 AF5E7BD937EA66E7 DFB219EED546F16C A7C045CBC5C856FF FF83E9DC664195BB A02A95C6D2E23F5D E3F11FFC28E7FC9C 9889D3675DC81D64 FE51AD64673CBB38 F1E3C224E1D29221 82DD3DABA1674BE1 7BA05882D2A58E88 933F986D49A8F283 3630CA9412E83F09 45DEDF8C5454D606 CD57735F8BB2C772 0E48EF63013BAC4E F4A9D49CD3CA2377 789ACC1AAC79FA16 FA5AAEFA1ADE58CA 5B968499BCA107F3 1238EFD0182D780F EC62FA3F93CCAAC7 961283004488F218 B8996B03533A60FC CB7352A8434A7618 558923766F9404A2 2358AC96CDF145B6 B337B30029B44AF0 01DB7F4F01A4B7F5 F0DC717CCA5E0EB1 A4B4EABAAF2D683E 9C901AD4E81B7BF3 0A9813B4D24D25A2 B50E5EC50C63702A 35727993B83A1512 F0934313D52BC282 3F71C3886CC50CA1 33969199EDE3CA67 1C06531283B2F73E 77263968D9393264 9D1D070F84D2C6C8 5742617BC6485EED D659A033CC1BC863 5E7793322830976D 427F1FF1B5079977 AA585B4FB8B75E2A 291D611CD0715AD1 D057B313FD5B4983 997D0686F3064278 691F7548438FF81A 36AEDE3235107159 962BBED09312C4A1 176FCE3A0E14C977 960761F7A2FBE0A1 AF28EC0C031D90DA FE579EB161E5DDE7 FD7181F8B3925022 ECCB575942045DE2 05A71371707CF7F9 86F3CEC735D8EAD1 DBD9B7C296559E63 30519D42B50A0D50 1D636A360EA8D27B 43A6BCF1A0E5FD7F 51CBA7F44DF83C56 E243B2599A1550BD C1B480A478D43DA7 98625A3036BB962D B32B3B4C81C5A187 567699A2425AB10C 86E00FB41EF251F2 C209497772CC8A22 DC55AADEF9DB69A1 4250A08DB7D0454E 00935733208308CC 953C5238C62EE938 7EE3F6C58D464AAD 68D1D1E6B85F83B7 1BF4616B8C22FBFA 7FE65CB8E3FE1B6E F1E95AB5567F3EC5 AEEB177FCCDE98CE 1359599194903A31 C38029EC6BE2C704 7C7EFE99F0F96A0C F0F89838CDB7B051 EB14E71A1446BDA8 D200457BDD1D1FD5 AD450D1CA04852C5 CBDC055D82E73CD5 898F2F5895217AF7 40AAE3089B883DB3 21B62A8EBC5BF694 E9E47EA88DE58F0C AD61AA67DF3019A6 8691A1122AF9334B 7F3451DA7855FC8D 407579B3D55AE775 F38B1D1692D34833 C56B7601E590C663 738395137F63A4AF EAFB7FE5DB6E041B 803F01A9E94B69A6 E1C1139DEAFAC09C 4E5DE643B27C7086 1C19BD60EC2AF33B 019B9C57B656ACA1 E5FF05CAEA3578C9 0A4C930980A3395D BDB5C0CC5CD471F7 13F574BA65B2C901 D2D4EDE0BE0D87B3 10E66FEC30B44649 E0B54FC07F23232A 35274FAAB31C5201 D30AB4530521B9F7 6422F0EC2F830118 DC6233F055D31EAC 84E7B4E191BCB650 51D18A288A5B0B4C D4C5C55C51433CF6 AFF70C55AAECF604 B27E42D584A01E4C 35F02101B776C9B4 D18E50F4EFFDFEC6 952057EE42169D33
- Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201210041102(name+title). Key = MD5(password) =adc5f411b3f7e7b0289b3c2389016fe4, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).
Decrypted: GUID list
1 2c49bda9-e12a-7b50-8e23-0761f9457101 2 4b4905b4-6d4e-7a95-9c9b-9774eef65000 3 a117ab7a-fc94-7c9f-8b25-5879b0aff941 4 d175b24c-20c1-613d-bd87-57b1c52cd242 5 3cb90f71-e4b2-0d11-88ed-d2fdafae1c4a 6 c0c8955e-30a9-0430-b7a6-e65c507b5e0e 7 35cb2722-d258-34d3-a4c8-f87403755dc0 8 1a1b4f30-3853-54f1-8d86-bfd512dc1a3f 9 cc883993-6052-5750-a3d6-ce0ab279b81a 10 7d8a2785-3db4-208f-9869-ab5b0c1ae088 11 be75c052-918f-8cdf-93e8-16bbf6db228b 12 649b3ce2-7c61-0f68-b415-1c1d19b34a36 13 3db27e94-4d2a-2c3b-8bc5-3fe3267d8525 14 dd5992d5-27af-6492-92a3-21547c192a20 15 21bb1742-077e-4d53-9fe4-291542e9cdee 16 e0d8a5fc-e1b4-4fe1-b68b-c5db707a542a 17 760f1f40-d8fb-634a-9c28-3a6fd4554bde 18 79830a72-77d4-63c6-af0e-f0b9d6bfe08f 19 9d11ad5c-f2a0-0a09-be6b-1e4144fbc95e 20 b6644fe8-ee2d-3f7c-af0c-fe9c95efe8a1 21 4e25e1bf-1ac4-8f59-891d-c2566c878edb 22 13a0b494-066b-2a1f-b997-d217242c24e5 23 0a2568bb-52fb-038a-9d6c-716ee2378005 24 278e185e-164b-46ae-869d-230e8f837511 25 1fb087a0-63fc-39c4-827e-04f3cb34b38d 26 494ce09f-b206-1634-9f78-997daa663b66 27 2f95fa9a-3648-8ade-a88b-d213133d7248 28 9b3f0576-4e90-290a-845f-8ec82b9579f8 29 022850f1-0e04-75fc-b14d-07deb87a05c4 30 01e24314-fe4a-13e7-87cc-7f083c8a73cf 31 45637511-05b1-245c-9ad2-9c701b785a6f 32 17c466af-0b48-7096-8167-2f54a9cb4fdc 33 07d3aa86-5654-18df-bead-5d4349f4a0c8 34 96c35846-eb47-58af-9819-7ca54e08c55f 35 6b11f6f0-0804-02e2-8897-2dabdad54592 36 1711b3c0-8360-41c8-90aa-bac8ca0c106b 37 7dccdb78-9bd2-8974-8406-11d1fd6043ea 38 0cf46fcc-bc3d-6c23-8f60-c2df0c22fac4 39 15b41cbe-3f02-2352-a701-b1e1ad69cbca
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
777600355280264466038204318271271504862. Exactly this sequence comes out ofnew Random(385).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 165 of Run 35 (seed 854,622,578):
new Random(854622578), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36). - Conclusion. Filler. The content is fully explained by the two RNGs.