201206261621 vnmkt
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 835
From the post to its content
As posted (encrypted)
E16BFA8139F78BE7 BD67507047E0D074 5E5898F63E59E720 67F9E7E66C8C8B36 D126EA2E684F575B B7E7B634478FFCFC 7D1B58E1A84543ED F76006997D654A82 3CA1E3087209B58D A755AD02BE9E1767 3CF59A6EFF9CECDD B8F9761A19525186 3FEE3F0516170B40 601C069BE02148D9 858A96B04B4B59A0 7DFCC0FE9C4F51B7 3BD37670C5657A8A B590ECDDD372ACE9 7DC9806B18587783 C0FF871C23871AB0 5B0B7800CB3BC1BF 2EE27BBE171E1F72 10D1F3DFA7554B7A F032B48208A5D3BD D4ABC65906C5D5C9 A97A71055BAA0D15 3493B8A8B20BE971 32E66E21B5DA946D 6D6D4435C821B817 C97F397E961738C2 3C3F994647813CE5 1BD4184A56C0BEFF F4363F05215E7BAB 3CE81FF23DB89899 9B81B293C9F35D88 F813D4FC92E0D0AF E3739323453A6200 FED9B38CC6E9EEEC FFC9493A10C11A03 D6F496C8348AFC78 9EE7D011AAF9C132 448943A0F1AAA818 987C6A53247F89F6 2040673DF87C33FB FFC14184ACD1AF88 8215597640BA7682 3432FE14E427FCFD AD7BE8705132E020 DF8229778F711590 C44D39232AA908D4 0F03FBFCA53E5D67 313C7B5F4FE55667 676BE8A2F839AD41 8DAF8EE394B77807 0A29863F98A3AC8E 4B69F750D6D28C88 E71FD042AB13FA76 01DFAEB1E79C0B19 35DAF76ADF342C0B E82C36C9767D9B86 C3C6ADD1EA35F349 997EF11D3ADF3737 2DBE4316BA9AB870 76E1454F150BF219 471131A3AAE0A926 E2B767F1CEB8087E 9E4667973823B67C 7C2EDCCD11A3D52E 715D0BCDAC3C8D07 EE76C9BB334BDB9B C56F01821D558693 0A29EEAA3F3AF3C1 A38567786AA127FE BA2F29F433C0CF45 A0F81D56D914A963 E2FBA0ABDBD4409B B2BBBDE5B0EE75A2 D0F8208138F82D21 3C73B2CF673E00DA 367FFA98F2D5AD3C 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 feb54333-010c-89ec-bac3-aea23f6cf5a0 2 e2f215d1-ebb6-7b62-b173-1752722cd181 3 f977006f-034c-3b35-84e1-0b8b7f3d9ae8 4 cffcdf0a-fe69-7893-aa57-ff3399332b6a 5 874745e6-f16c-1a9c-a371-ba81d586b5ed 6 b66c0d3a-f940-2c08-8bd1-6e2a045aa867 7 b7cc9fa4-1093-0cf0-9a91-d92f3cf09f36 8 dffa18bb-3cd7-30fc-84ae-61da9f237c3f 9 8cb1d1a6-5c36-246a-8dea-84b68439d1da 10 c5a4782c-cc1a-12eb-93a8-6b3f1d5dab90 11 59823a7d-5bee-4fa2-b714-425697f062c9 12 6b01f14b-5519-38a9-95c8-513d22685609 13 60e3de5c-beee-5719-a259-3509a4380103 14 12cb349f-2979-7cff-a906-63daa7329657 15 97258e7a-6f20-476a-b656-c8c7e1dc09b2 16 bd189d7a-1069-4d98-88c0-f85008e9d4d9 17 440d01d0-0274-7f45-a744-bc049a2bd7ed 18 82eaa3b0-074a-692a-863b-141886e771d0 19 e8fdd488-8c83-2afc-aab5-a8a68407082a 20 da589f2a-fa0c-5782-b29f-c31786eed5f2
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
87371203214357447625. Exactly this sequence comes out ofnew Random(835).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 3 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.