Stage 1
Question: apd
100 Points
Who?
File:apd-d54c4e84df46239dd
carl@b:~/apd/$ file apd-d54c4e84df46239ddd453f19909468c3
apd-d54c4e84df46239ddd453f19909468c3: gzip compressed data, from Unix, last modified: Sun Dec 26 14:06:22 2010
carl@b:~/apd/$ tar zxf apd-d54c4e84df46239ddd453f19909468c3
carl@b:~/apd/$ ls -al | more
total 9668
drwxr-xr-x 2 carl carl 20480 2011-02-21 15:36 .
drwxr-xr-x 3 carl carl 20480 2011-02-21 15:34 ..
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 0002abbac6e704c7196509c2bdfc61c6
-rw-r--r-- 1 carl carl 19772 2010-12-26 14:06 01149038c6aac54204c2850f5f8104c9
-rw-r--r-- 1 carl carl 19772 2010-12-26 14:06 01bf66971ba7601dc9bd99b2e9c38c90
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 023326ab4a8cbcc4494485bb2d4997c9
-rw-r--r-- 1 carl carl 19355 2010-12-26 14:06 0390f811e8ed5846d3cac7f8b4c8ad23
-rw-r--r-- 1 carl carl 19772 2010-12-26 14:06 03ced4264f06a6e2a35e5fa950bece65
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 04869a26051364f0c308eefd562ab8e4
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 06966a475ca30d06421f1e662dad4fda
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 08bf0534c5168bfc2e020269e90bf9b3
-rw-r--r-- 1 carl carl 19355 2010-12-26 14:06 09aa52fff54918a33c397e44efcf4339
-rw-r--r-- 1 carl carl 19354 2010-12-26 14:06 09ed6bd70d00ef97e6a4c8bc89249613
[...]
MP3s.. rock out!
carl@b:~/apd/$ file *
0002abbac6e704c7196509c2bdfc61c6: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
01149038c6aac54204c2850f5f8104c9: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
01bf66971ba7601dc9bd99b2e9c38c90: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
023326ab4a8cbcc4494485bb2d4997c9: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
0390f811e8ed5846d3cac7f8b4c8ad23: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
03ced4264f06a6e2a35e5fa950bece65: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
04869a26051364f0c308eefd562ab8e4: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
06966a475ca30d06421f1e662dad4fda: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
08bf0534c5168bfc2e020269e90bf9b3: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
09aa52fff54918a33c397e44efcf4339: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
09ed6bd70d00ef97e6a4c8bc89249613: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
0bfc1634806148c28b7a375b85b95e44: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
[...]
So obviously we had a bunch of really short mp3s. It was obvious they were spliced up from the same sample. So, we had to reconstruct them. Lets check the metadata:
carl@b:~/apd/$ exiftool 107deef8d71148a6f2d27d82918fd5fe
ExifTool Version Number : 8.15
File Name : 107deef8d71148a6f2d27d82918fd5fe
Directory : .
File Size : 19 kB
File Modification Date/Time : 2010:12:26 14:06:20-05:00
File Permissions : rw-r--r--
File Type : MP3
MIME Type : audio/mpeg
MPEG Audio Version : 1
Audio Layer : 3
Audio Bitrate : 128000
Sample Rate : 44100
Channel Mode : Stereo
MS Stereo : Off
Intensity Stereo : Off
Copyright Flag : False
Original Media : True
Emphasis : None
ID3 Size : 128
Title : R2hvc3RJblRoZVNoZWxsY29kZSAK
Artist : VElNRTogMTQ6MDY6MjAK
Album : V2UgYXJlIHdhdGNoaW5nIHlvdSAK
Year:
Comment : R2l0cy0wNDUK
Genre : None
Date/Time Original :
Duration : 1.20 s (approx)
Title, Artist, Album and Comment are all encoded. They happen to be base64. Looking at all of the files, the Title and Album are the same. The artist varies only slightly.
carl@b:~/apd/$ exiftool * | grep Title | sort | uniq -c
250 Title : R2hvc3RJblRoZVNoZWxsY29kZSAK
carl@b:~/apd/$ echo "R2hvc3RJblRoZVNoZWxsY29kZSAK" | base64 -d
GhostInTheShellcode
carl@b:~/apd/$ exiftool * | grep Album | sort | uniq -c
250 Album : V2UgYXJlIHdhdGNoaW5nIHlvdSAK
carl@b:~/apd/$ echo "V2UgYXJlIHdhdGNoaW5nIHlvdSAK" | base64 -d
We are watching you
carl@b:~/apd/$ exiftool * | grep Artist | sort | uniq -c
91 Artist : VElNRTogMTQ6MDY6MjAK
94 Artist : VElNRTogMTQ6MDY6MjEK
22 Artist : VElNRTogMTQ6MDY6MjIK
43 Artist : VElNRTogMTQ6MDY6MTkK
carl@b:~/apd/$ echo "VElNRTogMTQ6MDY6MjAK" | base64 -d
TIME: 14:06:20
carl@b:~/apd/$ echo "VElNRTogMTQ6MDY6MjEK" | base64 -d
TIME: 14:06:21
carl@b:~/apd/$ echo "VElNRTogMTQ6MDY6MjIK" | base64 -d
TIME: 14:06:22
carl@b:~/apd/$ echo "VElNRTogMTQ6MDY6MTkK" | base64 -d
TIME: 14:06:19
Though the comments are all different:
carl@b:~/apd/$ for i in `ls`; do exiftool $i | grep Comment; done
Comment : R2l0cy0wNTcK
Comment : R2l0cy0wMjEK
Comment : R2l0cy0yMDAK
Comment : R2l0cy0wNDMK
Comment : R2l0cy0yNDEK
Comment : R2l0cy0wNTkK
Comment : R2l0cy0wODQK
[...]
carl@b:~/apd/$ for i in `ls`; do exiftool $i | grep Comment | awk '{print $3}' ; done
R2l0cy0wNTcK
R2l0cy0wMjEK
R2l0cy0yMDAK
R2l0cy0wNDMK
R2l0cy0yNDEK
R2l0cy0wNTkK
[...]
Decode the comments and we get some numbers that we can sort:
carl@b:~/apd/$ for i in `ls`; do exiftool $i | grep Comment | awk '{print $3}' |base64 -d ; done
Gits-057
Gits-021
Gits-200
Gits-043
Gits-241
Gits-059
[...]
carl@b:~/apd/$ for i in `ls`; do mv $i `exiftool $i | grep Comment | awk '{print $3}' |base64 -d `; done
carl@b:~/apd/$ ls
Gits-020 Gits-040 Gits-060 Gits-080 Gits-100 Gits-120 Gits-140 Gits-160 Gits-180 Gits-200 Gits-220 Gits-240
Gits-001 Gits-021 Gits-041 Gits-061 Gits-081 Gits-101 Gits-121 Gits-141 Gits-161 Gits-181 Gits-201 Gits-221 Gits-241
Gits-002 Gits-022 Gits-042 Gits-062 Gits-082 Gits-102 Gits-122 Gits-142 Gits-162 Gits-182 Gits-202 Gits-222 Gits-242
Gits-003 Gits-023 Gits-043 Gits-063 Gits-083 Gits-103 Gits-123 Gits-143 Gits-163 Gits-183 Gits-203 Gits-223 Gits-243
[...]
We got stuck here for a minute, but then figured out that you could cat each of these individual mp3s together and end up with a playable mp3.
carl@b:~/apd/$ cat Gits-* > full.mp3
carl@b:~/apd/$ ls -al full.mp3
-rw-r--r-- 1 carl carl 4865279 2011-02-21 16:09 full.mp3
If you open the song in an mp3 player, you should quickly identify that it is Prodigy - One Love, from the Experience album, and also from the Hackers sound track. If you listen through the song you will get to some dialogue from the movie where Cereal is talking about the Da Vinci virus. At ~ 3:50 you'll hear the quote "The password for this hungry little sucker belongs to Margo Wallace". "Margo Wallace" is repeated a number of times and "Wallace" is distorted. Presumably they wanted us to look up the movie script and confirm.. easy stuff.
Margo Wallace is the key.
Monday, February 21, 2011
Ghostintheshellcode Stage 5 CCTV Forensics 250pts
Question: cctv
250 Points
File: cctv-88cbfd616c1ce146ca6b738772c10bea
The CCTV page has 9 animated gifs. Collect them all!
carl@b:~/cctv$ ls
code.gif davinci.gif destroycard.gif game.gif gibson1.gif gibson2.gif gibson3.gif hops.gif otv.gif
This took a long time while we tried a bunch of useless ideas.
-All of the gifs were exploded into single frames and each was checked for any watermarks or interesting information.
-We tried to find any hidden data stored between the frames. I hear you can append a zip file to the end of a gif file and each can be opened with native tools.
-Looked for something interesting based on the timing of each frames.
-Loaded them into gimp and noticed the timing was between 0-70ms per frame, which made me think hidden octal numbers, but this was a dead end, for now.
We massaged each of the files through imagemagick over and over with no results. At one point, I came across this page: http://www.imagemagick.org/discourse-server/viewtopic.php?f=1&t=11988 which led me to look for "ticks". Imagemagick's identify command can show ticks if you use %T.
carl@b:~/cctv$ info="%T"
carl@b:~/cctv$ identify -format "$info" *.gif
1531521641211231061411441461531541461521411631460120001101211051441441661701721261011071011061460120014616116414516116410112310410610110614716116414401200001031621411631501451441011561441021651621561451440120014114711010712116114116314414614112413111011014101201461411231071241211041431701411471461611470120000147131121161145141146144163166170147141141147012012114514114114614116314414612110513112210516301214612116414414717112514114416614217210114614614101200
I'm pretty certain the only reason this looked interesting to me was because I saw the file in gimp earlier and 0-70ms made me think "octal". Otherwise, I probably would have missed it.
carl@b:~/cctv$ identify -format "$info" *.gif > file.out
carl@b:~/cctv$ more file.out
1531521641211231061411441461531541461521411631460120001101211051441441661701721261011071011061460120014616116414516116410112310410610110614716116414401200001031621411631501451441011561441021651621561451440120014114711010712116114116314414614112413111011014101201461411231071241211041431701411471461611470120000147131121161145141146144163166170147141141147012012114514114114614116314414612110513112210516301214612116414414717112514114416614217210114614614101200
Break up the string into sets of 3 digits:
carl@b:~/cctv$ egrep -o "[0-9]{3}" file.out > file2.out
carl@b:~/cctv$ more file2.out
153
152
164
121
[...]
carl@b:~/cctv$ perl octa -a file2.out
carl@b:~/cctv$ more file2.out.as
kjtQSFadfklfjasf
NULHQEddvxzVAGAFf
SOH !1 1PNULCrashedAndBurned
SOHA9AAPfaSGTQDcxagfqg
NULFFJNLLFFLL))Q P
The key is in octal in the ticks inside game.gif. The key is "CrashedAndBurned".
The octa file is octala.pl from Mike Golvach: http://linuxshellaccount.blogspot.com/2008/05/perl-script-to-do-lame-encryption-with.html. Thanks to him for his script.
Ghostintheshellcode Stage10 Forensics 400 points.
Stage 10
Question: Hackerlife
400 Points
John doesn't see a problem.
File: hackerlife-0b8724a229d81bbb727d27d735eaca86
The file is pretty large by itself. It is a bzipped tarball. Extract it out.
carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86
hackerlife-0b8724a229d81bbb727d27d735eaca86: bzip2 compressed data, block size = 900k
carl@b:~/hackerlife$ bunzip2 hackerlife-0b8724a229d81bbb727d27d735eaca86
bunzip2: Can't guess original name for hackerlife-0b8724a229d81bbb727d27d735eaca86 -- using hackerlife-0b8724a229d81bbb727d27d735eaca86.out
carl@b:~/hackerlife$ ls -al
total 73560
drwxr-xr-x 3 carl carl 4096 2011-02-21 11:00 .
drwxr-xr-x 38 carl carl 69632 2011-02-20 22:53 ..
-rw-r--r-- 1 carl carl 75243520 2011-02-21 11:00 hackerlife-0b8724a229d81bbb727d27d735eaca86.out
drwxr-xr-x 3 carl carl 4096 2011-02-21 11:00 new
carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86.out
hackerlife-0b8724a229d81bbb727d27d735eaca86.out: POSIX tar archive
carl@b:~/hackerlife$ tar xf hackerlife-0b8724a229d81bbb727d27d735eaca86.out
carl@b:~/hackerlife$ file 6661024a3d7bbe441f8930e761a138f4
6661024a3d7bbe441f8930e761a138f4: ASCII text, with CRLF line terminators
carl@b:~/hackerlife$ ls -al 6661024a3d7bbe441f8930e761a138f4
-rw-r--r-- 1 carl carl 75231938 2010-12-31 00:42 6661024a3d7bbe441f8930e761a138f4
Looking at the file, it looks like an oddly formatted passwd dump. Looking through the list, it's obviously the well-publicized dump of gawker.com users.
carl@b:~/hackerlife$ more 6661024a3d7bbe441f8930e761a138f4
nicka ::: NULL ::: NULL ::: naster@gawker.com
Lisanti ::: NULL ::: NULL ::: tips@defamer.com
Choire ::: NULL ::: NULL ::: choire@gawker.com
Defamer ::: NULL ::: NULL ::: tips@defamer.com
gabriela ::: NULL ::: NULL ::: gabriela@gawker.com
trackbacker ::: NULL ::: NULL ::: trackbacker@gawker.com
wonkette ::: NULL ::: NULL ::: tips@wonkette.com
lev ::: NULL ::: NULL ::: tips@gizmodo.com
[...]
So, I got a hold of the actual list and compared them.
carl@b:~/hackerlife$ more gawker.passwd
nicka:NULL:NULL:naster@gawker.com
Lisanti:NULL:NULL:tips@defamer.com
Choire:NULL:NULL:choire@gawker.com
Defamer:NULL:NULL:tips@defamer.com
gabriela:NULL:NULL:gabriela@gawker.com
trackbacker:NULL:NULL:trackbacker@gawker.com
carl@b:~/hackerlife$ wc -l gawker.passwd
1247893 gawker.passwd
carl@b:~/hackerlife$ wc -l 6661024a3d7bbe441f8930e761a138f4
1247912 6661024a3d7bbe441f8930e761a138f4
Those are pretty close. Lets find what is different.
carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' gawker.passwd > gawker.users
carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' 6661024a3d7bbe441f8930e761a138f4 > 666.users
carl@b:~/hackerlife$ diff -y --suppress-common-lines gawker.users2 666.users
> havlarflake
> dragosr
> dino
> dakami
> 41414141
> ChrisPaget
> 0xcharlie
> taviso
> ero
> thedarktangent
> hdm
> invisig0th
> alexsotirov
> mdowd
> dionthegod
> evilcazz
> scarybeasts
> egyp7
> s7ephen
Those guys look familiar.
carl@b:~/hackerlife$ cat users
havlarflake ::: UtTv7enb7F7eo ::: NULL ::: Rmd4@gmail.com
dragosr ::: /3EK9FFao4Pg6 ::: NULL ::: aD92@gmail.com
dino ::: V2ImDfHvvzeGM ::: NULL ::: L3d3@gmail.com
dakami ::: HH1Ib3DcdRGSk ::: NULL ::: IGtl@gmail.com
41414141 ::: S8/2fLdvnSKM. ::: NULL ::: bS93@gmail.com
ChrisPaget ::: aRHvyiutiwz3A ::: NULL ::: PThp@gmail.com
0xcharlie ::: NVDC2543t.EKw ::: NULL ::: eSBp@gmail.com
taviso ::: 6vqZ23UFznzuc ::: NULL ::: czog@gmail.com
ero ::: Alj6D38tP79g6 ::: NULL ::: YXRj@gmail.com
thedarktangent ::: 0dOYtkSGSMR4. ::: NULL ::: LmNv@gmail.com
hdm ::: TxuDvnUnk94wU ::: NULL ::: VGhl@gmail.com
invisig0th ::: hBYhGy4dotTCc ::: NULL ::: TGY4@gmail.com
alexsotirov ::: oMCKEbmr9Kcx6 ::: NULL ::: ZHZH@gmail.com
mdowd ::: TGW6yISW/Ezzo ::: NULL ::: b3V0@gmail.com
dionthegod ::: 79mrBN2Qrejrk ::: NULL ::: dWJl@gmail.com
evilcazz ::: L6D79o81B8rL6 ::: NULL ::: cDov@gmail.com
scarybeasts ::: 6/gvMSbzDN1a. ::: NULL ::: aHR0@gmail.com
egyp7 ::: boREOx6UFvQF. ::: NULL ::: Lg==@gmail.com
s7ephen ::: m4bjrTwr9hbt6 ::: NULL ::: dy55@gmail.com
Those email addresses look suspicious, especially "Lg==@gmail.com". Anytime I see ==, I assume base64 padding.
carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com" | cut -c1-4 | tr -d '\n'
Rmd4aD92L3d3IGtlbS93PThpeSBpczogYXRjLmNvVGhlTGY4ZHZHb3V0dWJlcDovaHR0Lg==dy55
carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com" | cut -c1-4 | tr -d '\n' | base64 -d
Fgxh?v/ww kem/w=8iy is: atc.coTheLf8dvGoutubep:/htt.w.y
Rearrange the parts of the base64 string and you end up with:
carl@b:~/hackerlife$ echo "VGhlIGtleSBpczogaHR0cDovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PThpZHZHRmd4TGY4Lg==" | base64 -d
The key is: http://www.youtube.com/watch?v=8idvGFgxLf8.
If you visit that link, and you should. You'll also find somebody has beaten you to it:
"Wow, this URL is totally the key. Seriously. The key. The url. The key. realnamehere 1 month ago "
Question: Hackerlife
400 Points
John doesn't see a problem.
File: hackerlife-0b8724a229d81bbb727d27d735eaca86
The file is pretty large by itself. It is a bzipped tarball. Extract it out.
carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86
hackerlife-0b8724a229d81bbb727d27d735eaca86: bzip2 compressed data, block size = 900k
carl@b:~/hackerlife$ bunzip2 hackerlife-0b8724a229d81bbb727d27d735eaca86
bunzip2: Can't guess original name for hackerlife-0b8724a229d81bbb727d27d735eaca86 -- using hackerlife-0b8724a229d81bbb727d27d735eaca86.out
carl@b:~/hackerlife$ ls -al
total 73560
drwxr-xr-x 3 carl carl 4096 2011-02-21 11:00 .
drwxr-xr-x 38 carl carl 69632 2011-02-20 22:53 ..
-rw-r--r-- 1 carl carl 75243520 2011-02-21 11:00 hackerlife-0b8724a229d81bbb727d27d735eaca86.out
drwxr-xr-x 3 carl carl 4096 2011-02-21 11:00 new
carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86.out
hackerlife-0b8724a229d81bbb727d27d735eaca86.out: POSIX tar archive
carl@b:~/hackerlife$ tar xf hackerlife-0b8724a229d81bbb727d27d735eaca86.out
carl@b:~/hackerlife$ file 6661024a3d7bbe441f8930e761a138f4
6661024a3d7bbe441f8930e761a138f4: ASCII text, with CRLF line terminators
carl@b:~/hackerlife$ ls -al 6661024a3d7bbe441f8930e761a138f4
-rw-r--r-- 1 carl carl 75231938 2010-12-31 00:42 6661024a3d7bbe441f8930e761a138f4
Looking at the file, it looks like an oddly formatted passwd dump. Looking through the list, it's obviously the well-publicized dump of gawker.com users.
carl@b:~/hackerlife$ more 6661024a3d7bbe441f8930e761a138f4
nicka ::: NULL ::: NULL ::: naster@gawker.com
Lisanti ::: NULL ::: NULL ::: tips@defamer.com
Choire ::: NULL ::: NULL ::: choire@gawker.com
Defamer ::: NULL ::: NULL ::: tips@defamer.com
gabriela ::: NULL ::: NULL ::: gabriela@gawker.com
trackbacker ::: NULL ::: NULL ::: trackbacker@gawker.com
wonkette ::: NULL ::: NULL ::: tips@wonkette.com
lev ::: NULL ::: NULL ::: tips@gizmodo.com
[...]
So, I got a hold of the actual list and compared them.
carl@b:~/hackerlife$ more gawker.passwd
nicka:NULL:NULL:naster@gawker.com
Lisanti:NULL:NULL:tips@defamer.com
Choire:NULL:NULL:choire@gawker.com
Defamer:NULL:NULL:tips@defamer.com
gabriela:NULL:NULL:gabriela@gawker.com
trackbacker:NULL:NULL:trackbacker@gawker.com
carl@b:~/hackerlife$ wc -l gawker.passwd
1247893 gawker.passwd
carl@b:~/hackerlife$ wc -l 6661024a3d7bbe441f8930e761a138f4
1247912 6661024a3d7bbe441f8930e761a138f4
Those are pretty close. Lets find what is different.
carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' gawker.passwd > gawker.users
carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' 6661024a3d7bbe441f8930e761a138f4 > 666.users
carl@b:~/hackerlife$ diff -y --suppress-common-lines gawker.users2 666.users
> havlarflake
> dragosr
> dino
> dakami
> 41414141
> ChrisPaget
> 0xcharlie
> taviso
> ero
> thedarktangent
> hdm
> invisig0th
> alexsotirov
> mdowd
> dionthegod
> evilcazz
> scarybeasts
> egyp7
> s7ephen
Those guys look familiar.
carl@b:~/hackerlife$ cat users
havlarflake ::: UtTv7enb7F7eo ::: NULL ::: Rmd4@gmail.com
dragosr ::: /3EK9FFao4Pg6 ::: NULL ::: aD92@gmail.com
dino ::: V2ImDfHvvzeGM ::: NULL ::: L3d3@gmail.com
dakami ::: HH1Ib3DcdRGSk ::: NULL ::: IGtl@gmail.com
41414141 ::: S8/2fLdvnSKM. ::: NULL ::: bS93@gmail.com
ChrisPaget ::: aRHvyiutiwz3A ::: NULL ::: PThp@gmail.com
0xcharlie ::: NVDC2543t.EKw ::: NULL ::: eSBp@gmail.com
taviso ::: 6vqZ23UFznzuc ::: NULL ::: czog@gmail.com
ero ::: Alj6D38tP79g6 ::: NULL ::: YXRj@gmail.com
thedarktangent ::: 0dOYtkSGSMR4. ::: NULL ::: LmNv@gmail.com
hdm ::: TxuDvnUnk94wU ::: NULL ::: VGhl@gmail.com
invisig0th ::: hBYhGy4dotTCc ::: NULL ::: TGY4@gmail.com
alexsotirov ::: oMCKEbmr9Kcx6 ::: NULL ::: ZHZH@gmail.com
mdowd ::: TGW6yISW/Ezzo ::: NULL ::: b3V0@gmail.com
dionthegod ::: 79mrBN2Qrejrk ::: NULL ::: dWJl@gmail.com
evilcazz ::: L6D79o81B8rL6 ::: NULL ::: cDov@gmail.com
scarybeasts ::: 6/gvMSbzDN1a. ::: NULL ::: aHR0@gmail.com
egyp7 ::: boREOx6UFvQF. ::: NULL ::: Lg==@gmail.com
s7ephen ::: m4bjrTwr9hbt6 ::: NULL ::: dy55@gmail.com
Those email addresses look suspicious, especially "Lg==@gmail.com". Anytime I see ==, I assume base64 padding.
carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com" | cut -c1-4 | tr -d '\n'
Rmd4aD92L3d3IGtlbS93PThpeSBpczogYXRjLmNvVGhlTGY4ZHZHb3V0dWJlcDovaHR0Lg==dy55
carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com" | cut -c1-4 | tr -d '\n' | base64 -d
Fgxh?v/ww kem/w=8iy is: atc.coTheLf8dvGoutubep:/htt.w.y
Rearrange the parts of the base64 string and you end up with:
carl@b:~/hackerlife$ echo "VGhlIGtleSBpczogaHR0cDovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PThpZHZHRmd4TGY4Lg==" | base64 -d
The key is: http://www.youtube.com/watch?v=8idvGFgxLf8.
If you visit that link, and you should. You'll also find somebody has beaten you to it:
"Wow, this URL is totally the key. Seriously. The key. The url. The key. realnamehere 1 month ago "
Subscribe to:
Posts (Atom)