201209051230 zdi5f
explained decrypted filler
3DES(name+title) ECB, 47 GUIDs, seed 613
From the post to its content
As posted (encrypted)
9B08ADA95B471FE5 402A8680CE01119B 7EB634F8D0AC7413 47104570AE55DF20 DA07468EE8A31F07 BB353F74FC6671AF 7BF49B46052B9FC3 B577743E9C39C3CD F0D8B7DE17731326 FE51D3665DFE4E66 33D8B80671B22850 45EC77EF4C27E49F E4EE3C5123EB06AB B899BF44731978B2 C69FD44588A4721D 4027ED7BA5175E34 965D132AFB55FB1B D18878C344B10D7F 1F6F7C1FB7B4D834 5A05AB98A30D432D 5D4A9A1201B10689 6E673B656872103B 9B2683B3E415C9D6 D37CB4DE737B38E8 5CD3A2827709F4E4 EC23F9CB6EC114A9 D12EE7D0594919BB CB0913095537C98B 3D5FF54863D61CED 7D853D214127C3B7 0A408B6489CE2225 27E941A455C0133A C4CCE9B11CB8F047 A2C0DC38662CE7EA 6FF70C7641BA07B9 975392FD5F5A9155 918135167EA829F9 4B6776974A541560 7EC92C0E606BF49C FE232A4B91E4DAFB 70EFF3A325140B50 721338C16941B18C 3F2E0B452D0F701E A56F38FC997318D6 18E9EDED55AB23B4 A8E131DBAF483381 90899D916A23AD5F F1E8F2AE050E0FE4 A3A31EC9A820DCB5 72D7941DFF28BC0E 707E15B0DA4F0925 0ACF76E8AB296C92 8BC98DBD725C9904 48BD9FCF40A545EE EABA4876B3B0E49B 724E2FC864294945 F920A6A71C2EBBE5 DF1A3FC5EAF5532D B9C5A137A0D2AB7D 39348984DE2D3D4A BEF9E2060858BE17 818993C4D5847281 B45270C754A3BC10 82344DF97FFC17B7 C967A4D53331C5A5 304C1994E8ED1F4A 54E1615029A474F0 E80F6F16E1D6D8A5 F5F53BFEE09C6555 D1B6DCB03FEF4B2D 664DDC971AEA1E9C F2D8364F53045E5C 66E7D40CDF23BBE9 80456666DF06F7C0 223FAEB1CC8A100A 588279405A1D3C00 09C686B7322F767A F7FB2885E31CDC78 A333CBD229FFCF50 1D59D850373B1345 64E1774404AADC87 6E741D71281B0115 8D9FF5F3024E7DF7 89AE09030C28203E 54D9A6B39C4DE433 B679D9047E248142 FB0F7769857B817A E168A0E01CA9EDB6 50134E3964CD0E12 3E96CF59C13CA5F8 55DE6C687BC6F9C8 EC6CC23400804B20 83534E72DA05AF18 62217D455BC5D360 1243575EB242E7FC 8462C9FE8A767086 679E6C2286B4AAE1 C6B8BA33B8D613EA 216FF5CDB1F6D832 C5B67069D5118567 9744CF4716A2ED78 02BFCE6A07196784 FB886364B3C73384 CED7BF42E1AD5092 E606A0452E5A358F 2402CBC2906828FC B37F53C5A04CF637 76C4951D00B4AB32 AB1AAE957723B186 0471CC39EC3B9E2C F8CEB5CADA4844BF E441E05514CC6BFA EA2371BADB1427ED 00AE5A9A4831C08E A1800E3C01398914 3E747CCCD8B6D18D 45433F606D108891 8E2D2C60B0C2B998 8D34C69B702BCA2E 5E194DB738A3442B 0F196DCA8BB6EB04 4CE13937C1723240 DD23DE386CA72CEE FF0AC073F0EC4587 3CAF553CCA715698 B7C38318E209464E F4638B916CC895BA DC7E3773BD25712F 71C99552E263E1AE 57C0AB10AE3468FA 042B6BA6D75BD2B2 C50BD2CEEE08ADAA DC1DDA64FBD2EDA7 87B5E9BFBA254F93 6AFCA6F7F0E86BCB E03B30280E8D8BF0 26F6305E01118C2A 6899103C71B5A796 E1ADE3B667143A1C 39D956DAA59CBE03 04160F478825CE9E 4EC17F5A2B31027C C1A493438B97ED88 2D2C5F86F0B00F0B 7FF1B84630BD0370 91A79ED0FC6424D6 F30D5E2818C0885F E41A97AC577BDEAB 8AA2595F8C226889 6C4A36B53F9E119E 603815F7DDF27E01 FD511D4261D08708 D0186DDD931A80D4 5A85735C82B4BF46 1C9CCE0E2717E218 ED61F60EB8AB634A 453781077965CBA9 6C80884225733C87 E373EBAE626E55FC FEAB2572660414BE 667E59888F2CFE72 6495ADF32CDB7627 4CACBE085E8D98B2 84ED310E587051D8 D6117697E0DAD330 C514E6DBD8BB0EB2 CE13229C1A608183 27DF82BB9ED42439 01BD4C8182BA66E9 F7ED2E9F6684E589 FEF03F2A79C06A55 C17201B1ECA02D8D 615E5ED1DD0333FE AB672DC279C9FF99 9F99A5E10496D516 97A8367B7EE7E761 C62739C5F03369EE C359449C2F42ED37 CBC5235FC09AD39C 8DA2A3E019DE654D B1A44C5CB08669D4 45504CC9AD848D46 EA51FAAB03BE9A56 42F0EF55C146960F 3B1B0C58E7A63542 086545AF81FBCA10 FDA1D974C26308B9 B75E78E2A8BF8D30 EDB637A205E6D5EF
- Read the ciphertext. Strip whitespace: 3,024 hex characters = 1,512 bytes = 189 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201209051230(name+title). Key = MD5(password) =e71f88abdd61896fed126f57fc215887, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 47 GUIDs as hex (shown below).
Decrypted: GUID list
1 0f82e9c7-4d5a-8bd2-bcce-d7bf9a8b45da 2 0d894da7-78bb-6dcd-ba9d-e91f03cd6f7d 3 fcb3508e-9e91-2b6c-977b-44bb9dab1e60 4 c511f17e-bb30-348a-a3bb-7b23c36b2ecb 5 0069fac8-bd7e-88ac-a6e0-6056e9469038 6 dc1f5bbf-c0ec-2e7f-ac73-a0b13317fe82 7 0a2ec0a3-d661-572b-8aae-981c10f62a06 8 c6c319e0-54a7-86af-b237-f2995250db0b 9 02d8647e-1353-70ed-a95e-b8dfda7f4af6 10 653602cd-f9b0-2951-b2fd-5083aadd7187 11 6d46a7c6-b181-8a81-bd66-e5f734333f86 12 c9281052-0c4b-00ab-af71-026c1ff7a724 13 dacd7c40-f3c5-0d24-a012-57e97aaeebf6 14 c03862c9-fc03-390c-8076-03c8d475bc59 15 90739767-6f5f-00cc-b3c3-6672ae1ff91b 16 c4af1b48-3feb-7011-a9aa-4e34c450443d 17 49dc546d-15fc-4c20-badd-3dc4155a564a 18 e9d142bf-8b65-0513-b921-75808853b83d 19 85e9fe6d-88f2-291d-a9d4-225ce7318378 20 7e51abb3-08f8-6d3c-a6a1-4987a6f3b753 21 fd09307f-8af3-2367-9509-77c16b004963 22 21dcff5d-3ee0-2411-ba31-320956f87dd3 23 8be5177a-0d13-5e68-aa1e-7884975b40cd 24 5547b7f9-4b99-1818-ad83-d7ad4477579a 25 fb71f188-c9e1-6e92-9ddc-41aca9ba7857 26 4e100aa0-ea25-75e0-b822-e938bd566d10 27 df807271-d442-8891-b9df-67d7bb331e54 28 bdf1a0cc-22dc-4b95-9943-4a558a90ff76 29 f37099b1-854c-72fb-865a-e6fe7467037e 30 6ff24deb-0f0c-6ece-b2c9-4a2b4ad86f70 31 efd6a59d-8fd7-4aac-9a9d-77cb6902c078 32 61df3330-fa47-899f-b156-dc32f198bf77 33 2e9076bf-87de-7ea2-9dbc-edb3ed341e4f 34 0b381710-0dd7-344d-ad56-4f9a8943b78e 35 37a2e787-535b-6a63-8c85-8de732b03620 36 1ae92b36-b599-2151-9489-362d06b3aab1 37 5962f7f0-e994-7319-b31f-d195a7b9baf1 38 0021d200-ffc1-150d-9e59-134049bbfb79 39 e126cba8-2be9-2307-8a01-72c241c18501 40 2a7210c1-7847-0c73-844e-fa2772a39ec9 41 b9229923-5bce-089a-91aa-2d1d8c505ca1 42 c3c2e42e-6c46-0d78-9b7c-7bb2b9373b70 43 5aa8feb3-9cc1-7d83-8e4c-63cf544bebd4 44 f63d3bf9-475b-5a2b-9fb1-12d8ba700f75 45 e58c0b7f-6fa8-0909-b242-aa8eeff84f22 46 615cbd2a-f0bf-529c-854d-2154ece28538 47 9c51a455-68be-8584-9792-64b92ad2ebd6
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
86238258728003074026225167847648736271200075058. Exactly this sequence comes out ofnew Random(613).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 4 of Run 28 (seed 1,774,293,828):
new Random(1774293828), Next(8,64) per post. The RNG predicts N = 47; the post has N = 47 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38). - Conclusion. Filler. The content is fully explained by the two RNGs.