201210130500 11epxh
explained decrypted filler
3DES(name+title) ECB, 58 GUIDs, seed 397
From the post to its content
As posted (encrypted)
D58E09A853507C93 25EF5A12B098363B 48D622DFA031CD08 C9A1077E40EB92FF E8FDD9C2F1E463A4 C5A8D788A386A001 E8977A4573349131 25358C7EA5AEC997 227202472D719BEA 0381A1F3A0F507A9 162C78C4258D6C19 81AA70E875399052 F93C59910D3F0B61 A40C1C68D009E95D BF140E556F5233A1 5435CC96CF925332 F4A33234BD4875A6 435F6A32A79EE1F5 2E3AB1C309F4D0C7 F9F1301BDC5A8DBE F17FB342BFDAFF16 77B10D7A1810714B 519047AA09C5329B D214D9CC0E830522 C5F2067C7266DCAB B2A72A212FD1E9D0 2897DCF494FF1E0A 69E8EF5B0DCF8A75 F1723C6CF16A4C1C 8DD14358621FEC66 4DFBA60250D3575D 48BC19328CDAD2E2 C48B481C12BE91ED 4D23499AA0EFBD70 93346FD48B1D264B DB8D3D1D3138AEB0 D6E75317B7B9EEB0 92018569F3565224 07021A2BC25B19C6 626098702868844A 929C904EEF72F76E 324A7A54C14B4D72 C52B91B22EE3F574 D63BAA6AEB9DD570 F2BA63BCE954E953 25365AA4E495E107 DF2069D519010B86 5BCC6A5A6D44EF26 F5BE066DAE0C6E31 C8BDEFBFAF3EFEE0 E7ED8CCFE08B4E97 9ECDD38481A9DCB6 D4AA6DE4126C3CB7 B8CE24B54840909B F1E9E372052C8D63 053E5C89FC1BF5F5 EA68FAB4031FB3D3 A1376F2EF35289DF 9072944398F159C5 4899F3859A6CFE44 383B9BB5CEFC8BF7 C9BFA6D0FC010AB9 78F04C4B6803D85C 91BC5698BB805D54 A8BDC247A85F0B5D F9D450E704EF0A6C 5CE1E0523EA038C6 9B6631E6ADC5518D 9193C2249301044E 88B9344251ED4CDE 6B5F1CC80218FB62 471013FE151AA559 741B4030C76CE8ED 9B10E2AFA0619284 6ADBB49561ECBACE BBF150968F87F751 576F1AD8A5ECAE59 16983D8C885FD15C 83CF1E666D358A0E F6C6DE81B2887C82 61E8121D7FA7FE0C CC082DEADD419066 4BB1B74B74E61948 33C671D4BFDCA0FE 995139F571A5978D E3B5C26AAA8C77E8 101969CC76A85BEC 99903D37731F3BFF 6A2E9F952DD7A606 343C3DDD4F629019 2F2E7EBEFE6A8717 3DBCC924148A0940 88B443AF0B3F063F 7A8B69C4B577A0AD 07D0EFCB00BFC0B4 1D8406F672C23B43 75959062C004A31F 607685083D1E2505 724B317FDF8A27A2 FB6723C5F3C536FD 0F02315C0FF2D089 B6A94AD1D63B4230 1ABCB4B850B464C8 42C21D40A4362975 C4092FB5456309A9 B3629DB47C710A88 BFA68E8FB1AB8D94 8C764DEB854F3173 260D5F9CB23D2D77 706BF8E344573F8E DFE5FA44E489BDDA 465D391E814D9267 8CE1623949B0ED10 501B431738658037 62CD9CF74F73FC28 EE30C4FCFA116DCE FE49AAE7AA76B7FE 0E06A2186BF25002 1CFC6D2A1F5ACD19 B5BF0FC9CE6391D9 424EFFFE9F3C5C55 7B627B1BE51889B3 CE165514CE7B4AE1 514897E9ED20547E FA70B8CC09B3C517 E8A4427CB69C75C8 92D435B5EA1B992A 2ED87F7FBBEE1EB8 370728377E286E02 5857B027FD0BA563 9763D6D78C760296 C76FF5FAA0560BDB 8111B86CFB8A1D50 98C167AE0B12F7E2 A61F6EE66367D385 E19A8C1650960DC5 CE34089B33937FEC 69BF8430BFAB4036 F1C622CDE8C4CAB9 B60B4B1506E1FCB6 27FAAD9A76807ADB 2604473CE560DA2A 0DC3DFBBE732EB76 61B98EDD6BA3E58F C16332634FD35F97 1F62A6E8338E1BF4 96881AC3F6D82E64 FE4F86CFBB84B9B3 63A346A02DBD5012 B06BC0507223534A C5660EF72A49152A 2520EC161774B455 E3371A74D5A3E58E A4EDAD6C6CCBEA4A 58D64AE39DCBE24D 4E88743D30ABCBC0 FEE9280BF8A65802 B2C00617875E6142 58B528BAE0C4C2A5 4CC64808A29A887F 0161C45714BD4312 268BE9E0C06F6792 4D1E755EBB8DFF7F 782205E7E5050CE6 B7534B914DA43EC6 4549778524369527 818C8ED9FA648EA3 8A243E2617928C11 91A4A4F1B4393A84 F23DD3EA0FCD3B51 2AF3C7B5EC4BA689 2D3B504135075FD3 C9D1FDE1EA2AB757 A96B00284679C409 C9D8E61A89462174 897E59BC0FBC291C A909DDBD262290D0 9DA3BF5576AD6901 C7CB23A198F1DC9D EE9FA1BF547F24A7 6CEED6B38BD70C74 3BF0575B1A847AE0 A683581879B79D91 60560D25C81D5E63 E684ED82AD1048F8 FE3CA36281896566 E8B1EB92676F9360 1AC8039FFD88182C 91DA5F09CD5E127A 0C3E8FF8782222B5 800169B099722642 BAA02E63330E3977 2941C17768206774 9A07F7309AEF06B9 E941DE0E55CCD33D E07F5492BD103528 32FEF88CDFC8BE4B B4E153A136A33B84 90992AC58428B643 4E2271C0A13F00B7 160C5E22A8F46D90 04A270945AE0FB34 6B225BBDD0C78445 659E37E1AC4CC52C 0A31176B9EC636AC 5F6E1DA3F0E1025C 60DC008ECEDADDC5 1B0CA98476254915 FC211145747BC07E CC4A55CDC0962573 7BEF4E1F201C4B60 A61A7910E5B515A0 F08997778CADCF12 8B265BFA1D8012F4 E1BC3FA48A2E7DEA 203EA8EEC72EF229 8DB11DADB1B2C0F5 BCB32B2D4EC033DE F16BE68A95484D78 9AE6C977EAE3D2FB 40CE6023F213B603 9AC45342C941C32B 350EE8D22844A3D7 65A10FF80CECF213 D43C5D43D58CA2F3 ABA1FB6CAADDB468 9BAF8D559F63A02F BBA29DDB37C9743A BF3541EDD24FC0CE 1762DCA42E3D1EFD E4ACE63E12B38452 8AC013B6ED89DE75 96ABCAC22EE6ECD4
- Read the ciphertext. Strip whitespace: 3,728 hex characters = 1,864 bytes = 233 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201210130500(name+title). Key = MD5(password) =9003feefe631b42c78e3a4705c0741ea, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 58 GUIDs as hex (shown below).
Decrypted: GUID list
1 5c985a06-b39d-1175-b6d2-504c679fee1f 2 7ce8bd22-306d-2cc3-b3b2-1e75742a9b0c 3 2a047e38-9fd0-25ae-adf2-535a80e0c0e4 4 b6db0de8-88d6-20e5-985b-6d77ef5a43a0 5 996a94c2-3e5b-4f55-a4ad-e7ad469a616b 6 cb035ffd-bcd5-43f3-ae84-53ee71db0e94 7 f4b0ffc0-e73c-76fe-9e5b-6cc878a3bdee 8 a9e514fa-e09c-5f3e-9360-37dfe99369f4 9 b4778e14-9b83-08d0-806e-2303102e1eb8 10 75fc6b26-64ba-6cd1-aac9-cf3d94c51d9d 11 3b8771f0-88af-6d3f-b82d-242ffa17f381 12 274150be-e9f6-3353-ba9b-66eeb8353882 13 f6d73dad-0e1a-4602-88df-bbecba1e4008 14 3bd7f0b1-2c29-03f0-9920-3b64e14c9e0f 15 3e448e0c-c6d3-787b-bbb0-0bd659f3b4ae 16 14555391-bf57-8418-b470-8db5a4639031 17 d1106fbc-5257-66da-a9cc-479634a9d62e 18 dd16c706-cfea-1864-b1cd-57baf2c19e2d 19 78b5fada-62c0-3268-b96c-98ef0ebd1a34 20 10444dd8-c707-04ab-ab9a-0a43478bc7ea 21 dbb5a008-4a55-5882-ba3d-9a9a5fe86443 22 9efd8fd9-9ed0-2525-ab7d-d0a3fc29401e 23 d42fefcf-e548-0289-9bd8-38050c41cdae 24 de82ba71-585d-64d0-997f-63b54aae260c 25 6431c7c2-488b-58c3-91d1-cf95070b63c3 26 023ec128-b8bf-7654-940b-3c570806183b 27 857de830-4ffa-2c23-b385-3fc877a9d7ee 28 1b68b422-b5a3-6df0-a80e-2a5823b74177 29 de55f81b-961f-112f-ac5f-c55ded88d65c 30 d914b9d9-1864-7870-8ff6-653093dd7d99 31 500fd34d-ad1d-63cc-a529-5cd0d77b674b 32 256b2669-c612-07a0-ba44-78558d824984 33 d84a4de9-73d9-83f6-aa3e-e6a21c86a75d 34 2bf7e09a-1785-805d-9e8a-249eba855904 35 a394d4d2-f27e-2009-8e68-b23d21f2ae71 36 f07cf4c6-ba6b-8601-8629-47b4284ce43a 37 7d9d9a89-83db-7c3c-88b7-4df27bbf8ace 38 63f73b0f-ec78-82d1-93b0-ecdfa829cfd1 39 ee301b5a-85e3-2b26-b753-7270a4aae298 40 137fd9a2-4547-32b2-8067-bfcfc9b9ef63 41 8a69a395-ed0f-2a9b-9ce4-9aba5df0699d 42 7ee240da-dbe6-0c84-8494-160f7de08df8 43 73477843-cd17-2eda-93e8-260b7b0b91c5 44 c98d7974-7838-1ccc-8dfe-556902d35f96 45 9efa86a0-67a9-19cf-aef1-6835e5976bad 46 a91d97a8-db2b-3e17-a6e9-e326fbcb48ed 47 3aaa9b97-8628-3c6b-ac49-879ccd73bc9c 48 14254223-7d4b-676f-a3ac-28025c4a8a12 49 9487acc6-314f-86a0-980c-5d8443bbdd3b 50 08235b21-b5b4-6686-a58e-ac26b4753ee8 51 97caf2b9-e02d-4d63-b4ad-fc9a8851e109 52 3cebdcf2-a353-5f38-8dd6-4cc717fb77ce 53 fbb90fa9-05fc-1352-b2bd-48f1ad7bd731 54 35868cb2-fa13-33ca-a1f5-dce8f3f70b90 55 43b014cb-4220-69f0-9858-1d4120f8c3e2 56 e0fb5142-7865-7e0b-aa4e-2a12d9473b7e 57 371e2361-e584-178a-82f3-6fa562c551ba 58 4ad88cc6-e9d4-4bc3-9fc5-bbd7e86f99ff
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
1222447506634078613052065726176088287823202113368645136714. Exactly this sequence comes out ofnew Random(397).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 15 of Run 36 (seed 335,015):
new Random(335015), Next(8,64) per post. The RNG predicts N = 58; the post has N = 58 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54). - Conclusion. Filler. The content is fully explained by the two RNGs.