So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an encrypted file, not sure what type of encryption tho: So I wonder if this might aid in decrypting the text file? The text file is much longer than what I have posted but any help on having a go or guess at this would be grateful.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
closed as off topic by Rory Alsop♦ Jul 4 '12 at 16:58
Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
This is a Base64-encoded audio RIFF/WAV file.First you need to Base64-decode it (for instance, with YellowPipe's online tools) and you get (sorry for the one-line ugly format): You can see from the header that it's a RIFF (.WAV) file. I don't guarantee that the output above is entirely valid, as I'm not sure how trustworthy YellowPipe's tools are. And unfortunately I don't have sound on this PC so I cannot listen to it!! EDIT: You mentioned in the question that you only provided an excerpt. Obviously, you'd need to reconvert base64-decode the whole file to work on something useful, not just an excerpt. If possible, please post the whole file to Pastebin, Dropbox, Google Docs or something like this. EDIT 2: It works perfectly fine with your file.
It just doesn't work with YellowPipe because it outputs to the page and you probably damage the output when the browser uses a different encoding. Using a decoding program or another webservice like MotoBit's Base64 Decoder to send the output to a file gives you a valid binary file, which you can rename to a WAV file (e.g. Do that and you can listen to the message. Then I don't know what the Applecore key could be used for. It could be that a secret message is embedded in the file by steganography. I assume that's the trick. |
|||||||||||||
|
|
The content of the file looks like it's base64 encoded. I'd try looking at it in hex to see if there are any recurring structures/sequences that could hold metadata (e.g. the stuff in the beginning). Then I'd download http://www.cryptool.org/en/ and give a few ciphers a try (trying both applecore and the hash as keys). |
|||
|
