201207060635 w3hcr
explained decrypted filler
3DES(name) ECB, 24 GUIDs, seed 767
From the post to its content
As posted (encrypted)
15B1CD2E95C08971 1875B6B2F3DFF8D5 BEC67F7ADCDF51CB C073F2C9341A10F8 DCB3F5DC1659F672 8702268706CC7E06 777CA3B68A68A2B2 FF20135DBE44415D 248DC70EEC1D42C2 C203651B517CE0EA C1B48D6A0F15690C BFA2C841FFDB3A1F EC19A8B6366C2AC4 DC3BFF5327206501 5AD0C3B38D607E8A B0A57605E3B63958 C5F517859611543B 0E8295D06A206401 63DACA576E988616 DB0A143AD58D963C 728F378DC9A8EC33 1A3AB254CF312F69 0CD5582ABD9320BC A1AED99BC4675845 95136000E797F312 945EE57725731226 7679E9560B4A1736 CF440CEA9A6B5C8F F5F533D15C43B49A F15468AE5D658F99 4D202A0076EA683A BEEEEAD73A90CA85 EB6DA27CE9FAE85C D670F0AC086273DF 8F90357B4718877C 3CECE04265287455 E5F26458A21D662F 9B586D9F8141DA1B 630971BE0E6269FC A3829985C805785D 025AC6357332B29C 077314E3346A0495 34BC9AF09CEFECE4 50C1868053FDE006 D369F8F63D10A426 1074A80A045C3926 6874572BC35AF592 C03E03D7CE98CCC1 7024B773BDDBA72B 11B6FFFB91564A03 E7F0ED96AED30CC5 35EA98645D091906 E5E177AED308E38D E58CAE6E5BE3DF0E 42DCB0454DDA7EA8 8A03C995ACB8510F 8F205C0714CDBD97 448410AECA95B1B7 2642F763DC87DDC3 31D7DBF69DBC2DD6 8CD3CE03C11B06C2 1364893606C65271 75A66C35C6197B69 6D3F56B94B51273E A5ADC9E4C033B8B3 E85D83C1A217DA9F C40547AB93A7F7B0 343EAE28B02B5AFC 5405E9B30D1B57F0 81628A26D313E8C9 B95A2E5DAA46D118 FD25BD4094E60DAB 0E60078890A8FC64 68D34D092EBD5DD4 005955103BB98171 82D228D9F0D0D72B A1FECF6CF4886A8E DFF9B0D7C1B9A383 C9CDA906B367E349 C4C061066E5B145F 26A73D8314200D70 BE658A5F770E7C62 46D914E015F12473 AD034AE8CF56B2C6 2FB597A1A842A016 057E710B1739A465 F55D6FABA7809F1B 5EE8137F3FD13978 AE8DF87402C0106F 0CCD63B1F99FFD03 289E5DB74A6C3744 D6EF82D7A389423E 83FAB9A9F164A6C5 4C9C9F246B17A3F3 5E49566625147D9C 382E20924C7348D7 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).
Decrypted: GUID list
1 c57a14f6-040a-3ef0-b245-bda8b40452b1 2 e1d1093f-af97-719f-9054-83a62982cf37 3 0d35d477-e7cf-8e45-9a6b-1cb8c8afbd7a 4 5028836e-a55f-2cb9-82f1-4264a75bd193 5 f9ebc21c-afc0-4f13-8961-2a0556bce191 6 1a82db0f-f7c3-7d46-8151-9f72c93b9c99 7 339ba818-b8ff-5ba5-a824-40e63cc5bd3c 8 e5020767-29d4-258a-a7b5-5a80f06e3fbe 9 f014afc0-c9a8-7849-a88f-aa14c1e1b995 10 b14665eb-a9d8-0574-ac7f-6c36bc844401 11 d53817fb-8ab8-3089-9e87-51c6b9f8825d 12 c471efb7-85a5-2021-9648-f4351d0caf20 13 8f6fce93-853c-82ce-9c92-0c41253318aa 14 37651379-daa4-490c-91a4-2795aa7e1634 15 326a8619-558b-7ba8-ab7f-a1579b47403a 16 56d7de68-9cd0-0799-8d0e-e0463453d446 17 56b99504-f368-264c-8463-286d2b9540d1 18 cab61f72-4d64-400f-8725-9f374cef4544 19 6832e660-c070-39ba-80a1-4cf05aab3292 20 10cfd995-d71b-20ce-897c-c36b899504a5 21 ec562192-e044-6730-b21e-c9509b2f4c04 22 c4c9933a-41f7-0b9b-a97f-c5e7b2cbc6c6 23 a26820ef-a770-5ffb-91e5-8f368080a8b3 24 1bd1d7b4-c7ac-89a5-9f8e-dbc56e2f8d72
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
378247527032847024326058. Exactly this sequence comes out ofnew Random(767).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 1 of Run 11 (seed 37,057,156):
new Random(37057156), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46). - Conclusion. Filler. The content is fully explained by the two RNGs.