201206260847 vmthn
explained decrypted filler
3DES(name) ECB, 18 GUIDs, seed 936
From the post to its content
As posted (encrypted)
EE48CCA45319BA03 B6244E9FAAF62D85 6F865623E2AC20CB 876C130E6BFA60F0 980AC401687C0D23 97BC0DDC272B3B9D 8490BAB93CEBE89C FBFAEB4ABD38BB6C 91A6EA9665466136 00A2F0F7834FE9B3 75F23696A21707C6 75CBACFABBD47604 E793DCA7959B1595 983A675DA55BDEC7 B6F8A2BA7C34AF01 85E4E6E2D29F7E79 9817800D5B60318C 667108E81A4DF825 5933802B1BBE7FBD 8090574BA2D29D3E C925409732E24AED 27175D2C20D071AF C6CBCF4D667884F5 05ED15877E3E8BFB D2644A303E990B46 7B5C48AEFCE33BBF 357E563D2BA19797 342F320991C7E7F0 2DAE0D4FA912DDB7 49BB89353BD8BFAA C5DAC54831109AFC 98E8914A781F2878 32F2CE0947595368 F52FE9658A06ADD1 E4A44F22E57222AC 06E1A4D8741F6E75 5D1979DC5AA559D9 E25E8241D4179F7C 7C290E444A493DEB 122402E02ABC0B29 DC2379ADCB4A3922 C515DB7FEDCC54E4 D8C4202F30F678DF 51B7041FA6FF098C D9BD7E41695F8CDC 1661C48935FDDEC3 BBB9ACA1159E7DE7 E2CFCD773126402F 6CCB7F066E0F9791 E793DD6EB3486B75 612DA64326C224B8 C786649CCE3979DF 3C8BC328FD28273B 13F9708A1A272A1B E6E77475669A86AD 3030EDB0A3143B43 C0195E0FCBCF194C D18A5242752C575E 9097A7E07B06FB2A DEB0DF0BA0C9F020 7AA2617612F46CD5 CC419054D280F802 E8BD5F8F0914CE34 1D2645AF1B8219EA B791B1296CE5FB9B DE9944E5143563C2 529AAD5C6338040A A3348191EF24793A 9BFAEA470AE51581 BE2253EC40EA62D0 53334654E13B1354 0D850C1D13F44F10 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 22669c01-4792-6af5-8e39-6c9bf4390063 2 2bfafb93-6992-481f-8b10-8b70cea2ec07 3 492a3e83-3cc6-0fc7-bb37-98e7182dbf41 4 7bc2490f-715d-34c8-ba8c-e151e3404023 5 cc553e11-0325-705c-8b7e-3dbed293d326 6 4d036848-bda3-4e8e-85fa-917f723a9227 7 6ca0e4fe-6732-2c68-91a5-185c2790602c 8 8d00aae4-e98c-0bc6-8380-753853ce3a55 9 fe0027ba-cad8-64e9-9eb5-7e7fa6efddaf 10 c8e4ac8c-40f0-3d2b-8242-215295ada1e8 11 df2b70a6-b6ab-7c53-a517-46b7a65b84d2 12 03fc6e5d-77e6-1617-8d40-970345227680 13 8cb2cd2f-174e-09ad-a8e3-075107765d2c 14 5cecf45a-4621-3c4a-9624-aaa391aed842 15 8ee44877-5aff-1063-97d6-655d9d748f8a 16 37219d85-d21f-58ce-b13e-4300d112a953 17 e84a1f3d-a015-26d5-af8d-8cfab78a6c69 18 6ffe44f5-a3d4-29c9-a997-1689fd2338c1
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
640374206371031522. Exactly this sequence comes out ofnew Random(936).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 3 of Run 2 (seed 1,054,905,639):
new Random(1054905639), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31). - Conclusion. Filler. The content is fully explained by the two RNGs.