201206260944 vmwu4
explained decrypted filler
3DES(name) ECB, 13 GUIDs, seed 527
From the post to its content
As posted (encrypted)
AF42550812C87CD6 F6BD9EA48311A9CA A92C4EE98AA3F56E 38F66E78243A477B 5ED0F3E6D216863B BCDB3841A4AD9E42 7266D0D191232B0F FEA90968830F4FB2 F30AC1773391AB78 43F854A48AA76F68 47443986AB834AE0 1C25A8D1904BE6A2 74595B7902CC1374 FFD0831227E082F2 1DCC5EC563C18EAE 13BB6718FA2F838E 6CE83DBE77E746CF 64BA88C52537FCBB 480CD5F479F7BD3D 70F3F9BA65004FA7 D2194469CE35A8C5 3560421FFCE2921B CFBC6EA4131650E9 831100B9CA742FA5 E2CC872FABF2997A 9A7A49E6EBD6D293 D57C371D32E0E214 FB216C92CADEA91B 677CA4BE97EB3A61 D0C9164E34249B7B F5B70AF2F1F62205 26C04D22429F15A3 967495BDCBCDC102 194E743F29153C42 BB300AD95EB48E24 B1E6372ECE6F4E2B 7642314A5B1374EB 16EF9399FA3AC95E 321B2744D3CA4F4E BC5C616D9E949732 F96A39A05B2D5617 56F946FDAB101DDA A02C74C28D3A5C66 2855253F7876EF34 CA555817234FC8E7 AC684FEA72EA44F4 CE0924B55EBC16B6 B2FC265054155D70 A1BC421E06F7539D 4308F7F1CE5989E6 616CEAE04FE5F08C B497225528B16B9E 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).
Decrypted: GUID list
1 e297e91c-bbad-0a84-a241-7ec1c7474d09 2 c2813c3d-874e-410f-a127-2b99fde3b49c 3 b4f1c9df-f042-1b6b-988d-83ec62b9436c 4 90954760-c72f-0bb7-b579-58252feb7770 5 b1859d7d-272e-17ff-935f-abe277338a0c 6 a0a67301-d497-05a3-87dd-c7a0ddb3511f 7 319957cd-5a37-033d-a785-a508ff7f4e3b 8 0337b2fe-0ac2-731e-a6c5-3cfca391bb6b 9 67be4d91-c46e-1d94-8f91-9130b60b13fa 10 02b5ceca-6758-54d7-b526-37675e02aad1 11 38c9ee75-f5d3-4bff-85ec-6ae794e0da15 12 d63a2415-6c4f-87b4-9551-477e5340c160 13 9882d882-38f8-8b21-8b35-49c51f84770e
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
0410100715488. Exactly this sequence comes out ofnew Random(527).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 16 of Run 2 (seed 1,054,905,639):
new Random(1054905639), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31). - Conclusion. Filler. The content is fully explained by the two RNGs.