Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an encrypted file, not sure what type of encryption tho: So I wonder if this might aid in decrypting the text file? The text file is much longer than what I have posted but any help on having a go or guess at this would be grateful.

share|improve this question

closed as off topic by Rory Alsop Jul 4 '12 at 16:58

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
It's obviously Base64 encoded and shows clearly visible patterns. –  CodesInChaos Jul 19 '12 at 8:51

2 Answers 2

up vote 2 down vote accepted

This is a Base64-encoded audio RIFF/WAV file.

First you need to Base64-decode it (for instance, with YellowPipe's online tools) and you get (sorry for the one-line ugly format):

RIFFº WAVEfmt U€>Ä  ´qfact€©data| ÿó8Ä[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿó(Ä_[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿó8Äš[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ§^X$BÁ!a³33û¸ŽÂÇ5»ÂÏ9Île¯=‚ˆmÒ4üÊ1>CP–È3ó]ö™#H„‘ †‚då'¨eÎpÉÎ Z4hä@ †Ûƒsœ2ç°@Ââ‚üÎ1?Åð–È.sô€º„&#FÞÁD¸ “'=¨B{PËœàêË‘@ƒ ¾ä¢… 6€ Á&*AŸL¨23    Rq¹-Eœà  H£c”™ÓìoLJÊ",aÉ/ÿ2ŒOðì%².4v(¼2I¤òàÊ"’ëMÐBX=Êd2@ÐêÌ‹‡‰ty’n˜Ã’%ñØ;òYdXX3"‚DrÿÌãüŠ«f 1 ”0sdG¿ÿÔîƒ&ïÍìpÑͤ‹ÿý7M h³ü@Qä4c r(‚““K£O&#65533; ´’×mc    ájÖ¡†hóyºH  1A äÐÀ˜Âr)cÿÌ£L–I†Vi¤Šä¢q£‡Y?©iW=²öMæäûâSQÌÙÞtu‚a¡1åÂñÁ-‡›PöVÙ³x7±˜ö[üðÊßÿ3ŒG‚S/§Ýyµ€½Œî™íÏ5mOÊâ-ÿ7ÿÞÆ3gþÖÙüÁPµ:Œ%Kˆ>Å”Èbms É8ô/H   !¬e~£óԹܿ“Äkvû×ìJÈ~gqñïïMö—¬ßÿÌ£h{6ØyǾ½­j‘zÜ5äH§k9vcya ·Ò46aûΨõSø€µnë_ÿ`‰­ÓGX¨Þ‘ÿ3ŒAQ.Uü’€ÁX20Fq²7þJ$Ž…?8›VBÊÊsŒÞOÔaÆ?§¬™ÿä8"ŸÙ€ (þ´Uè„FeÖEKN[³Š8Yµú¿ßôífâa‘øÚò¹ÿÀ 7ÿó(Ä1Šå–C siõ}½sb4§A¦NÔXqNü««Èº‚ BbCK7J°A£ÀxƒŸë8fŠ¯v¡ÎèÿÌã@<;—OMˆ/ÿH®‹…IÍ„e-˜1éJÞ¯F3E’Y†Ö2ý›öå>UXP†ÊIˆè¶@    C   áÅÄ':2;12y…pÌ*JJ!|'’¼«Y íŤC«]peÌ¿ûÿÌ£Ì@«™8AIñ·¸¸žÓöBñÈÿüp} Ÿ•ÉÌÏë&gu·Ñk¶Ð8åP!eLË!ZBœ mæaU¿˜Ëe:Îç{ÿÌã¸T‹9@Á*ðýþêAA7‘k¹¦Î £ÞÍŽØ„b®Å¥ÿô¥®ê(ýÈåvÇÔ-!<û=¡ÿ*n9 1ó™~ 'øÚÜæà2ö^Éh‚„†;)E0f§Nnêè2ÿó(Ä92æPFüŒðM(Z?ä´Žõƒnˆý7;d`/1Δƒ1 YŠš²>dÆŒÌÁå™Oü å{”(’ÿó8Ä0 á’FüÌ<Ѹ8=ZƒßÏyPçÐ Ó©Ò×”  pN ¶þiCûêH²>g¢»u8PÃIœ4£¶1MÚ>0ˆÂnÿí(—º, ^5¨bXuèÿ½,@B€yU^à_ÿ2ŒDÁîmh˜HC ¶ÝZ}jß9ÊVü§þ­{ŽÝpΆÎrOÿÔ´Œªu:‹)F1†·3ÿDº:KÌüÎ1D ƒ´[¢ÁîQœQ:÷TÁ×ôÇ<x7ä)¨ttßF™Õ«T·S͙܌‹_àBeü²Ì•T…šªú?ý&´WÃ@p0:ÿ$¥5zžÞÄÚѪØÿNÉêz°¸H_ÿÌ£ˆAȆðe; Ào÷þÿÐÊT1P™ÝÁB‹‘Õÿýáÿï@Æ    ‚Ëk®?/Cñô`Íï’új.!öÿ3ŒEÁmF¨I̾ÄÒHx>³„!-$‡!íI$µþ¦`1z &½ ›äL6ßÿýBäz0@¤ÄM˜ñ&.»w(j¨è“†ù­÷1I£õ›$ýK<I.fh’Ûu-þµÊ,)]€Ÿ/ÿÿó(Ä{AÒâ,h

You can see from the header that it's a RIFF (.WAV) file. I don't guarantee that the output above is entirely valid, as I'm not sure how trustworthy YellowPipe's tools are.

And unfortunately I don't have sound on this PC so I cannot listen to it!!

EDIT:

You mentioned in the question that you only provided an excerpt. Obviously, you'd need to reconvert base64-decode the whole file to work on something useful, not just an excerpt.

If possible, please post the whole file to Pastebin, Dropbox, Google Docs or something like this.

EDIT 2:

It works perfectly fine with your file. It just doesn't work with YellowPipe because it outputs to the page and you probably damage the output when the browser uses a different encoding. Using a decoding program or another webservice like MotoBit's Base64 Decoder to send the output to a file gives you a valid binary file, which you can rename to a WAV file (e.g. audio.wav) and listen to it.

Do that and you can listen to the message. Then I don't know what the Applecore key could be used for. It could be that a secret message is embedded in the file by steganography. I assume that's the trick.

share|improve this answer
    
i tryed changing the file type to see if it would play but got nothing... –  Kirsty White Jul 4 '12 at 18:52
    
@KirstyWhite: there might be other transformations to apply, and that we haven't found. I don't know. –  haylem Jul 4 '12 at 20:37
    
@KirstyWhite: for instance, you mentiond a key in the question. Maybe you could experiment with that. –  haylem Jul 4 '12 at 20:38
    
@KirstyWhite: hang on... you mentioned that the text file is much longer than what you have posted. Did you try to reconvert the whole file? Because I obviously did it only on the part you gave us, and that would obviously generate an incomplete file, which would explain why it wouldn't play. –  haylem Jul 4 '12 at 20:40
1  
@KirstyWhite: tried with your file and it worked fine, see the edit. It's not encrypted. But maybe it contains a hidden message. –  haylem Jul 5 '12 at 12:58

The content of the file looks like it's base64 encoded. I'd try looking at it in hex to see if there are any recurring structures/sequences that could hold metadata (e.g. the stuff in the beginning).

Then I'd download http://www.cryptool.org/en/ and give a few ciphers a try (trying both applecore and the hash as keys).

share|improve this answer
    
+1 to you as you had written your response while I was trying out several encodings. Hat tip. –  haylem Jul 4 '12 at 16:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.