201206261611 vnlzb
explained decrypted filler
3DES(name) ECB, 23 GUIDs, seed 304
From the post to its content
As posted (encrypted)
8886B512781CF99C F9096B720B32B8B0 B81D20BC24C89FD2 0173F11FF6185E34 3ED5CCEB0B761546 DEA16D35F3D40442 8006B08A0AC082E9 CAF4920DD8BB250B 554FB465F68C2F6D F843CE96FA250539 AB3E7954693AC3AB 63FFA67885DE2DE9 F328CA1185989828 D81FCAB531E93B6B B34D1A8D974CBE76 7609C2DE7CA8BEE0 80D9184EBA43F2E5 C5EAA10CD49807BA 27DE5AF2B0E89731 9A435D4CB8CCF5A6 B9AFD7AD4ECD466F 0B14AABED38286BA 5B722BF08DB72DC8 D62CFD3FDFE5D794 950BA98DB55FA01E 41BBB44E56998C21 0112D8E3AA33B8D7 EFBC1DB36B4EC834 1FA63AD1AF7A4A6F 37A614225FBDF8B1 EA2C505BB04AA354 0C71D4C91862E589 C9858302F5A3FB84 CEF7C48E5099573A 0D83B96516E900AB A2CD52F284408A69 ABBE48F0AE244663 05C8E17820CF5F0E 83A9D26BBFE44B14 5FB3A0DFEF08DE3F C0841F5C7FBB76AA A672CFBE47EFA869 2C8F0F31E286B574 765BA4D8C76110D2 406C9A562BFC6F0D 49F1DCA1AD5D8D59 2D916E06A4A5ABE5 EA9D8BA70764B0B8 2AF8D92B1DFD34A4 B93888FA62621038 364AC3888FD2F505 414D6E49D0333E31 10D246E033FD4E08 07946E09F28BCE6E 871DE6275993F963 68C7875355354B22 7048D528D7A7F8CC 816569A390FEFB4E CB58B051C5DE05B4 4239879651899F9F 1EDA0E82A835457A CC66EFE489202E3B FB2AEDD4BA2874B0 EB135769F0707CF9 89860DB719838501 8645E64B198A0E55 9612C702565171A0 D3F4F0BAB3A82DE9 75D92997AA3F86D1 B4466DF28115D690 77DB3342532D1093 4562800C4D81ACFF 302DDEE822A3988C E3CDB1FCC20ABBE0 00F38A133C4726DF 08CC34AB3F2CC0AC 5CDBA704482826E8 8113F07F6CE24EB2 D4152BE2C37E97E7 DC8D50D5AF0A7792 242372C1732691AA 257192F395EF5151 9E84BEF2DA895DBC 980F6D9DF767BA74 E678A76EAD10062D 9DDAA60334277755 EB03A84F58AA6FE8 E6F665F38E2CF82E 9C858263B33E9E8C 3871B3238D83628C EFB796C2656CF8AE E3FE1B5FB2E9D9EC 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).
Decrypted: GUID list
1 4e2616da-b55e-4528-8ae5-1fc5842d254e 2 c5764fe1-110e-02cf-bf5e-bc622f67d7c6 3 63057167-b39f-2ebb-a644-2528507a3b51 4 315d354e-ee8a-4cf0-be14-8ac3bb10c0a1 5 bbee06ea-9f16-455f-8f3b-51fca8401272 6 68c28428-f6ba-2284-9ac0-cd8a14935989 7 eb027be0-460b-1b52-a238-52e67d3d74c0 8 623017b6-dc20-8d06-8080-75d397ebac32 9 b692421d-7ef0-50ee-926e-7f3ffbc5a862 10 620515b3-39ac-3ee4-8e52-462a90d8ef0a 11 9d3f8fae-3c55-265e-8077-459e83a74cbd 12 300709c8-1a8a-794d-8b52-a3bb7268e557 13 911799e7-cfa1-5ddc-adff-90c9455b2e32 14 cbeefd13-89a1-525f-bac1-2f60f480f4ac 15 5aa8b964-3cfa-633c-964d-fdbe93eae6ed 16 9ba5df10-e264-75f1-927f-08953eae5cc4 17 1134fd49-9d69-549f-8c1f-90eb7aad8023 18 961ee5a7-b513-4a3a-b829-3e53db014911 19 914a23d3-a9d1-8e76-872c-cd387fd2acbe 20 b23ad314-350a-0f19-8bcf-8f60c095dc8f 21 9c9c1729-38e3-1c32-a290-cb860c61947b 22 8f418bf5-0bf2-32bf-9c14-7a6db805d287 23 ad33c993-5559-335e-bf5f-6565d5fe0a39
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
40244218532755675480133. Exactly this sequence comes out ofnew Random(304).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 0 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.