201207182330 wsrho
explained decrypted filler
seed 17
From the post to its content
As posted (encrypted)
D0133E4E19199F87 AAE85D7C209747E2 D09BBD14B1268FD8 75A206CEF84DCA86 A04412028C495AC0 F8B5ED3112554BCD 173CC9B99D34A7D9 48A8E941A3790BFF 8003682C8B0D6558 6EC12F670BB0335A 7128A17A33D7DD67 9281200265B5A72D AC58B878255A0B5B BF0FE84716F2C586 0F2BDA1E5B24BC69 18A43D816DDCAAD4 F713AEEF5A41702F 8024CFEBF086584C F1781BCB3817DF07 C39A191F21FA299C 4869E47ACBC49709 7A44B9A2BFC2F9D4 EB006B681EA42FE3 6A3A6D4FA7FE10E7 342FD44D0BF318B8 0B3C0064910D855D 5A1B1D6885E1D318 1C551835194C0E88 7389AC58D8AFFBFA 83A7E1320FE5707E AA6C60471771C60C 00E4C6BF02A10BB4 7A8A47EAB0B8FF0A ABAF82C77CDBF805 C058A602B6C4C6E2 02F3BA2375112157 81A1C35B9CA9EC4E A66C4960F77748B1 CA08E4215E8EA33F 6E31704EB730FC2D B8319F06795EDD24 715B2E8566577E77 FF5EA40AEF077988 7F9CD3B08B977623 78391942BE5E5B35 338DFE8C4DD77767 3B04DAC98BB68867 5DC1176943C4CA07 CAD12A5D468AA5E1 0D21620D30B2B90B 3362D283F1E5AE71 451789FEB28C1C0A A88C02F2F53BB05F F00CAAB1D793C41E 9EA38DCF37C13A2B 7C636ECE8C2B90E5 2B52592C546FE68E 2EC345A42FBBE6C4 1DD1776EBA1F7AC1 9A5F84637564E01A FF64E1ABBC5DDC7F CEE3C05D9B0D0F9C 544996844A4D4864 DD263D3ADFB9DEB3 8CA3E3850F96142D 73A3948F68F5E77A 8BFC0F7E68AF5917 75A149E5E558C810 F42E882D6DC76BCE 6121FFF0534A5389 79806BA99A551DA7 8C10AC4AF9182EFB 6F46A19A13BE9B18 992CA50B498DA5AD C7273F94875D5DAD A23ED9BDDA2F463C FE18EAF08862B8D6 6457CA476143885D A80504090696DB78 A690AC171E15D942 BE0DCD064D718394 29C1429F5B070621 781DB7BC0F2B9D1E A118A18729B2E5D2 6D37DB95DC4B21D0 1508E22534D50F01 7E8A11251C78D71A CD866F427BB91EC7 E184D1C1812065CD DE202DE158950ED9 EFDCA415A80A4C56 E3479808005AA8BD CDE47EA73A46762C F1B4C9E37D2E45C6 333336CBB317460A EE661D0D1741D0C7 0246156A26226514 5FE0BBD52BA123D7 1DED38C881FC6FE4 626530E7296CC6C9 25E38E5079474ECB 4F419EE524B1165E CC5519EB766F9EAA D4B49EF6B7B188E9 BC0157B86D459917 2B74B0936C67CA3D A325DAB22338B07E BB2AB29D5D6D0709 954E28DCD39FCE78 221F8B793B98AA7A E010B47B447C976B 79D0FC177DBC103A 4F99101443E23B54 FA688793CE276001 F16D1494D6FC8CAF E7C27A079A31AE41 88D5455D46A62A37 E47DF7884A115959 882F6E0DC8547271 86D8F94BB2435BE7 6B8938DFB9264EF4 FDDE055718E08668 641B5CC8DCB51555 8010C38AB6BF8E1A 7E4D30DAB1D20D23 3E8650D04AE8A6F0 DF9CE9A97F8EF73F 7136757EF13C97A4 1762C4C0C351D914 6C94C29994487473 BF2449D3751099BE 815FAF0C22F77A74 5A5CA3F1E5FA9B62 D6AB77FB135711A4 7F395EF87F80B444 E207A20D14D81F00 CB4F5A200CC447E2 2943D6723B89B1E5 7C276E66C6EE3449 C4F1ABF81F561F1B 8BD5D946B0D31EF1 ACE2B70C92FABC56 91D98F4E76734FF2 3D6AD77CC8659F8F 378D61A7CE786485 5A5F06E7A4550B9B 7A126408A5F23032 F46B738D86A3A820 2C6C1EE9A4915E05 35270D06D5D2CCF6 AED3204505533357 557C312002ECEFD3 37559C52998FEBD8 C2C5E1E956B9EEE5 77198393C1C11C8C 2F202DEAAF446D0B EB7A633E69ACD3B6 59FB98C6C5843FA1 EFD7343F75485B2F 08364790A6BF81FE FCA35FB6EE823F0F 2EFB8BEDDD581C01 DFEE09FE151CCE4E 2365234C2A92E793 E16D097E6584C40F 53C19D83DC33ABEC 980FAD6CE778BBA3 BC9131974FF0EA7F C30D4827CABE048C 26F6E56AAE955E72 D2B8AFF0F91C183D DD670D8695C61AF3 AFA199025B80A3A4 42F0A82C2802CB13 EEFEFBE81151AD85 48ECE910DD79406F 4916424D1F0C6F35 3E7213454661A855 E601409698C85D19 200DC853527404A2 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 2,896 hex characters = 1,448 bytes = 181 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 45 GUIDs as hex (shown below).
Decrypted: GUID list
1 9b1e8e87-c505-56fe-9f59-8f2ccf5726ee 2 0e4da819-8f01-7352-b060-d5e66a6f1b64 3 5a7d869e-84f3-5a1f-8834-27c8e12d86de 4 ebc33bca-ad3a-19ba-a24b-1bb0ee6c37ef 5 a9e97196-1f8d-76ff-83d5-a405fb12d35f 6 a361d89d-91b4-3289-8c25-3679121643bb 7 b35690ad-3ae6-450e-8fce-592e25c8ac7a 8 f169b100-85fb-85d1-93d8-f3cff87934a7 9 feaeee92-46f4-0336-84cd-a8b6560531ca 10 9f9adbd9-d1ce-439a-93a0-96ea5ae4d98e 11 43d6d179-62c9-766a-a165-6057c4efcbae 12 e4ae902f-b1f3-6396-b5f6-7b9281b5267c 13 b3e6e654-3d6b-26ee-96a5-7f0510eeaf84 14 79a15647-2a2a-2fde-b057-0d9c1879d897 15 78b6995a-2869-72ea-b7ce-065c910d3416 16 94182b17-74cb-5385-99d3-a26633b5cfd7 17 753770f0-af70-0282-99c6-71c6c163ed74 18 4d7de748-bd47-4ed1-89f3-add8df0ff333 19 bdd08921-8eac-1b95-8bf7-84efd1ef5e05 20 0958d3f6-cf2d-8ea3-b58b-44652534dc8d 21 7e57467e-4f16-0817-9c1d-badb5856d3df 22 233568c8-9676-0c88-acdf-b257cdceb5e3 23 67ea568e-c423-7048-947d-ae05bf6b42ee 24 d93c4dfd-f19f-8e70-92ce-f51d4cc2a2a9 25 ca6e61b7-7421-30f6-87ef-3cc5783c433c 26 8d88ad24-fdde-4b4b-a5ba-bdb695c411ad 27 01444f41-a36d-4321-8da3-76ef59497cc1 28 8c2c0659-843a-1968-beb7-8de88e1968e4 29 3e82bac9-bb0b-2bb1-8e32-57e305719aae 30 77afd543-5ce1-60e9-98f2-5a642686901c 31 769e5ba9-522c-4f60-874b-e98c2db96e6f 32 41591d07-a5c8-84c0-8b3b-366a24d3b3a9 33 a8dccec0-2d77-1dea-8848-733a515e0dad 34 a0101089-2b39-3201-a8b6-cb5793f51b53 35 066966eb-248f-5a8d-9602-95cc3a664f52 36 7335ada3-ec46-490c-9c3a-59891e33803f 37 78e2126e-8eef-1878-8554-f38770fc42d9 38 ce749078-0033-83c3-997f-6c5caaf5b379 39 60d6b8ef-2b3e-2d0e-9571-0a9a603b43c2 40 62380642-eabe-5f54-b8d3-855ac6d51ce7 41 46a408ef-d043-5dd3-a8ef-cb15c14c5846 42 1d770348-e505-3512-b1ed-38c4dbb2d02c 43 a482f4d4-6f9b-7608-9c72-57b6e9e239ea 44 49aa8a11-15ad-1a2d-8789-9fb5d1619856 45 7a31555b-16d0-766c-9239-ca6bcdff3aec
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
575173480476227504180078344126481354182553717. Exactly this sequence comes out ofnew Random(17).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 14 of Run 17 (seed 38,757,453):
new Random(38757453), Next(8,64) per post. The RNG predicts N = 45; the post has N = 45 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41). - Conclusion. Filler. The content is fully explained by the two RNGs.