1

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an encrypted file, not sure what type of encryption tho: So I wonder if this might aid in decrypting the text file? The text file is much longer than what I have posted but any help on having a go or guess at this would be grateful.

  • It's obviously Base64 encoded and shows clearly visible patterns. – CodesInChaos Jul 19 '12 at 8:51
2

This is a Base64-encoded audio RIFF/WAV file.

First you need to Base64-decode it (for instance, with YellowPipe's online tools) and you get (sorry for the one-line ugly format):

RIFFº WAVEfmt U€>Ä  ´qfact€©data| ÿó8Ä[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿó(Ä_[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿó8Äš[ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ§^X$BÁ!a³33û¸ŽÂÇ5»ÂÏ9Île¯=‚ˆmÒ4üÊ1>CP–È3ó]ö™#H„‘ †‚då'¨eÎpÉÎ Z4hä@ †Ûƒsœ2ç°@Ââ‚üÎ1?Åð–È.sô€º„&#FÞÁD¸ “'=¨B{PËœàêË‘@ƒ ¾ä¢… 6€ Á&*AŸL¨23    Rq¹-Eœà  H£c”™ÓìoLJÊ",aÉ/ÿ2ŒOðì%².4v(¼2I¤òàÊ"’ëMÐBX=Êd2@ÐêÌ‹‡‰ty’n˜Ã’%ñØ;òYdXX3"‚DrÿÌãüŠ«f 1 ”0sdG¿ÿÔîƒ&ïÍìpÑͤ‹ÿý7M h³ü@Qä4c r(‚““K£O&#65533; ´’×mc    ájÖ¡†hóyºH  1A äÐÀ˜Âr)cÿÌ£L–I†Vi¤Šä¢q£‡Y?©iW=²öMæäûâSQÌÙÞtu‚a¡1åÂñÁ-‡›PöVÙ³x7±˜ö[üðÊßÿ3ŒG‚S/§Ýyµ€½Œî™íÏ5mOÊâ-ÿ7ÿÞÆ3gþÖÙüÁPµ:Œ%Kˆ>Å”Èbms É8ô/H   !¬e~£óԹܿ“Äkvû×ìJÈ~gqñïïMö—¬ßÿÌ£h{6ØyǾ½­j‘zÜ5äH§k9vcya ·Ò46aûΨõSø€µnë_ÿ`‰­ÓGX¨Þ‘ÿ3ŒAQ.Uü’€ÁX20Fq²7þJ$Ž…?8›VBÊÊsŒÞOÔaÆ?§¬™ÿä8"ŸÙ€ (þ´Uè„FeÖEKN[³Š8Yµú¿ßôífâa‘øÚò¹ÿÀ 7ÿó(Ä1Šå–C siõ}½sb4§A¦NÔXqNü««Èº‚ BbCK7J°A£ÀxƒŸë8fŠ¯v¡ÎèÿÌã@<;—OMˆ/ÿH®‹…IÍ„e-˜1éJÞ¯F3E’Y†Ö2ý›öå>UXP†ÊIˆè¶@    C   áÅÄ':2;12y…pÌ*JJ!|'’¼«Y íŤC«]peÌ¿ûÿÌ£Ì@«™8AIñ·¸¸žÓöBñÈÿüp} Ÿ•ÉÌÏë&gu·Ñk¶Ð8åP!eLË!ZBœ mæaU¿˜Ëe:Îç{ÿÌã¸T‹9@Á*ðýþêAA7‘k¹¦Î £ÞÍŽØ„b®Å¥ÿô¥®ê(ýÈåvÇÔ-!<û=¡ÿ*n9 1ó™~ 'øÚÜæà2ö^Éh‚„†;)E0f§Nnêè2ÿó(Ä92æPFüŒðM(Z?ä´Žõƒnˆý7;d`/1Δƒ1 YŠš²>dÆŒÌÁå™Oü å{”(’ÿó8Ä0 á’FüÌ<Ѹ8=ZƒßÏyPçÐ Ó©Ò×”  pN ¶þiCûêH²>g¢»u8PÃIœ4£¶1MÚ>0ˆÂnÿí(—º, ^5¨bXuèÿ½,@B€yU^à_ÿ2ŒDÁîmh˜HC ¶ÝZ}jß9ÊVü§þ­{ŽÝpΆÎrOÿÔ´Œªu:‹)F1†·3ÿDº:KÌüÎ1D ƒ´[¢ÁîQœQ:÷TÁ×ôÇ<x7ä)¨ttßF™Õ«T·S͙܌‹_àBeü²Ì•T…šªú?ý&´WÃ@p0:ÿ$¥5zžÞÄÚѪØÿNÉêz°¸H_ÿÌ£ˆAȆðe; Ào÷þÿÐÊT1P™ÝÁB‹‘Õÿýáÿï@Æ    ‚Ëk®?/Cñô`Íï’új.!öÿ3ŒEÁmF¨I̾ÄÒHx>³„!-$‡!íI$µþ¦`1z &½ ›äL6ßÿýBäz0@¤ÄM˜ñ&.»w(j¨è“†ù­÷1I£õ›$ýK<I.fh’Ûu-þµÊ,)]€Ÿ/ÿÿó(Ä{AÒâ,h

You can see from the header that it's a RIFF (.WAV) file. I don't guarantee that the output above is entirely valid, as I'm not sure how trustworthy YellowPipe's tools are.

And unfortunately I don't have sound on this PC so I cannot listen to it!!

EDIT:

You mentioned in the question that you only provided an excerpt. Obviously, you'd need to reconvert base64-decode the whole file to work on something useful, not just an excerpt.

If possible, please post the whole file to Pastebin, Dropbox, Google Docs or something like this.

EDIT 2:

It works perfectly fine with your file. It just doesn't work with YellowPipe because it outputs to the page and you probably damage the output when the browser uses a different encoding. Using a decoding program or another webservice like MotoBit's Base64 Decoder to send the output to a file gives you a valid binary file, which you can rename to a WAV file (e.g. audio.wav) and listen to it.

Do that and you can listen to the message. Then I don't know what the Applecore key could be used for. It could be that a secret message is embedded in the file by steganography. I assume that's the trick.

  • i tryed changing the file type to see if it would play but got nothing... – Kirsty White Jul 4 '12 at 18:52
  • @KirstyWhite: there might be other transformations to apply, and that we haven't found. I don't know. – haylem Jul 4 '12 at 20:37
  • @KirstyWhite: for instance, you mentiond a key in the question. Maybe you could experiment with that. – haylem Jul 4 '12 at 20:38
  • @KirstyWhite: hang on... you mentioned that the text file is much longer than what you have posted. Did you try to reconvert the whole file? Because I obviously did it only on the part you gave us, and that would obviously generate an incomplete file, which would explain why it wouldn't play. – haylem Jul 4 '12 at 20:40
  • 1
    @KirstyWhite: tried with your file and it worked fine, see the edit. It's not encrypted. But maybe it contains a hidden message. – haylem Jul 5 '12 at 12:58
1

The content of the file looks like it's base64 encoded. I'd try looking at it in hex to see if there are any recurring structures/sequences that could hold metadata (e.g. the stuff in the beginning).

Then I'd download http://www.cryptool.org/en/ and give a few ciphers a try (trying both applecore and the hash as keys).

  • +1 to you as you had written your response while I was trying out several encodings. Hat tip. – haylem Jul 4 '12 at 16:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.