DECRYPT_NOTES.md

Mysteriously encoded data

Apparently downloaded to some WSO variant that allows for encoded data to an eval().

POST parameters:

[pass] => nhzgrf
[a] => NxAcGg==
[p1] => KB8hGjEEMg...

Thu Feb 8 23:06:30 MST 2018

1. cp -p files from /var/tmp/ to files/
2. Run ./extract, creating encoded text files in directory data/
3. Run ./uniqit # weed out dupes based on checksum of encoded text files.

File uniqs has file names of unique encoded text files in it.

Wed May 2 22:40:46 MDT 2018

• create_flist copies files frim /var/tmp/ to files/, creates flist
• cksum *php.file | sort -k1.1 | awk 'BEGIN{cksum=0} {if ($1 != cksum) {print $0; cksum = $1}}' | awk '{print $2, $3}' > uniques

File uniques has <size,filename> of unique encoded text files.

Unique enoded text files look like they're Base64-encoded: 76-character length lines, no-eighth-bit set on any byte, all printable ASCII letters or numbers, except for ASCII linefeeds, '+' and '<' characters. The presence of '<' characters is the only unusual thing - Linux base64 command doesn't use those in encoding, I don't believe PHP's base64_encode() does either.

See wikipedia's base64 article to puzzle this out.

Fri Feb 9 10:47:11 MST 2018

Create data files by base64 decoding unique encoded text files

1. Run ./create_data Uses file names in uniqs, puts decoded files in base64_decoded

Files in directory base64_decoded/ have the decoded unique data blobs in them, named in file uniqs

base32 -d doesn't work - invalid input

Find index of coincidence for all data files

1. Run ./icit. This gives file index.of.coincidence

Find % compression of all data files

1. Run ./compress_data

Compare index of coincidence and compression ratio:

join index.of.coincidence compression.ratio | sed 's/ /	/g'

It compresses better with larger data files, and index of coincidence goes up.

Comparison

File test1.php is 3666 bytes of PHP.

Vignere encode it: ./shift -N 127 -s 'abcABC1(&)^@#$%!' -r test1.php > test1.shift

$ ic test1.php
test1.shift     3666    127     0.010
$ gzip -v -c test1.shift > /dev/null
test1.shift:     23.6%

That's pretty similar to the files in base64_decode/.

Compression guesses

1. gunzip doesn't work - not gzip file
2. unxz doesn't work - not xz file
3. bunzip2 doesn't work - not a bzip2 file
4. unlz4 - Error 44 : Unrecognized header : file cannot be decoded
5. unlzma - unlzma: base64_decoded/1.179.246.8: File format not recognized

Find key length guess for all data files

1. cat base64_decoded/* > all.decoded
2. vigkeylength all.decoded 4 50 > length

Key seems to be a multiple of 8 or 16.

Looks like different keys on different files, maybe?

Considering all files together seems a mistake.

Wed May 9 18:03:08 MDT 2018

• create_flist copies files from /var/tmp/ to files/, creates flist
• cksum files/*php.file | sort -k1.1 | awk 'BEGIN{cksum=0} {if ($1 != cksum) {print $0; cksum = $1}}' | awk '{print $2, $3}' > uniques