201207271425 x9nxb
explained decrypted filler
3DES(name+name) ECB, 21 GUIDs, seed 516
From the post to its content
As posted (encrypted)
044518385196780A 8129D555BA51DFCF F719769864744A3F 9A47F24AAD568E2F 6199F3B0B92F05AA 6BC5429FD93D48FE 820524A8F36356C3 B74C8828566FCB55 1A4CF97D7F33A5C7 9F01F33E5DBC33F2 C0385F1CEE28D000 8A5F9B132B6C0D39 6C93A6A7455EB42A 4DD725F3EBD9995D 4838D6546B017CAE 247431A25E502213 F1514BA389E53DF9 52F01398CF8D5273 08AF88E80A27BBB5 CAA8105319536FCB 97D8AB0A53C918CD A37DD229BEA032CD BBEA36324B63FAC0 37F660E087069F59 EAD38E215C171142 6F0629EEB4FAA775 B74BABF4FA2959E0 3EBA9D094E019C35 F4857F47C1A540CA 67B4332E7FF976A1 50DDCACFB7D072DD DA8F52C63E23DE64 70A33E9E2FD8F2E5 4A3D91C590A6DEDC 5128CD10F69A4D07 2662C11BD5911DA6 972EFC79EEE35D2A BE7E566504FFC5EB 89DF84E92391B655 6A8460FC590D6FF5 10FCEF4123D2292D FEFAE370D45169BC EE15E6302FBE1A3C 49C53A6048C5CC8B 33792E641900448C 64A2CF1593A67913 7AAB37CF2082390F 932E3E56454B3084 67F1F23C95B88A5A 5D3B501B467C2EDD 461BC8B3EC9B52ED 410CFAE24963D758 A3305DB67BEA9769 F2BF9DA3A10FD4F0 D3F61FD50C2FA5BB 9CA407ACAB1C50B2 AF20FA339E8BAFCF A4C8849A0194779C 69E92EC2B9CECB45 68753F3C5C06D809 BDDEEDED22516C57 E29681383B5C4B75 6A1E0C60AF7686BA 6C15490EA4DA0FD0 9EFFB71C76EECFD7 0B3C988BE545492B 760A3FAFDD5B3A13 EB91B7D23C5743F6 1B227DFBD612366F 38BD68AD9F4063E9 1C04B7D34BA78867 9EF9E712F4C6ADBE 0B9AF032056150D2 9E3F3AE0CBBBB09E 6171AF8600939FE6 878E6A2BF06B03D8 04DB21087762C9F9 BCD38425FDFB698A 90AA5D42E0110BB7 49E07B41AE59181C 38AD38D0053DA691 E44B9B915DC4BD02 371E99D87E9880CE 3B2E5136211D7ADA 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 4abe4180-f128-2f6c-b538-d1ab3fbb8823 2 eac51bee-9a10-1725-8caf-1b6321534c4c 3 5f427c31-f919-486e-92c3-83a623ab1713 4 b2a69c95-2cc1-6f0c-9abf-7ac34a4ee295 5 866b2ed6-af4a-1ffc-93d7-cc7337d14c37 6 d16191ec-68ae-45e7-8b6c-3b58c1a91d65 7 d5426fca-1195-0d72-9622-826f2b2835de 8 80450def-03d6-26ac-9bc9-f35c2f2dc36b 9 dfa18d58-4f3e-7c77-9e6d-54060f5e09c5 10 23d50a40-04ad-4c0d-821a-2d757bc3ec80 11 c86058b7-0d49-4f98-9d76-21d3dd1db43c 12 75e182c5-2e07-22f8-998f-375ef734ad1e 13 1d30cf43-891f-3ce8-bfd4-9469f5b205ae 14 0d35dbe1-b2c3-81c0-9476-207314ede655 15 9ba2bebf-53e3-1aac-9068-8861d4d50ed5 16 2ee58660-01b0-25cc-9cb1-609f998a8e3d 17 6dd7855a-1fe9-6a31-96f8-257ddc9578fc 18 0cff07b2-879c-8cd0-9399-e59140e4dbe7 19 cd5f8a13-f970-5c2d-b7a2-4b53c02c183c 20 0a40f3da-69ce-16ee-bc08-ecdbaf0872a2 21 3e448e30-c391-36e5-8ae9-390d2c05a7bc
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
214614027442381268513. Exactly this sequence comes out ofnew Random(516).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 25 of Run 18 (seed 6,051,781):
new Random(6051781), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.