CODEWITHSUNDEEP
phptextbase64enigma2
Thomas
Thomas

Reputation: 95

Need help decoding ?base64?

Me and my group are currently trying to decrypt certain messages for a big school project but we just cant figure it out! the idea is that someone "hacked" our raspberry pi and left tons of breadcrumbs that we have to resolve but we get stuck on this piece of text:

V2VsY29tZQ== VGxSTVRRPT0= VWtWTk5FOUVSVEJSZWxFd1RWVlpNRkpxWkVWUmExWkRUVVJWTTFGNlp6Vk9NRmw2VVZSS1IxRnFUWFpQVlVwRlRXdE5lbEV3UlhoUmFrMHhVbFJuZVUxclZrTlBSR3N4VG5wU1JrNTZhekZTVlZsM1RucG5QUT09 V1RCak1XUXlVbGxUVjJScVlsVTFkbGx1YkVKbFJURkZVVmRrV2sweFJqUlVWVkpDWkZadmVXUkhORDA9 Vmtab2QxVnJOVVpOV0VaWVYwWmFUMXBXVW01bFJsSllZMFphVGsxRVZsVlVhMmgzVkZkV2NrMVVWbFZOUmtwRFdsWldOR05XVGxsWGF6VnNZa1ZaTVZaR1ZrNU5SVEZ5WlVSYVdrMHpRbEJaVjNSV1pXeFNTR05GTld0aGVsWkdWMjV3UjFSWFJuTmlSRXBWVm14S2VWUlVRVEZXVmtaWlZtczVhRlpIWXpVPQ== Vm10U1IxVXhUblJXYmtwT1ZteGFVMVl3V21GVlJsWlpZMGMxYkZac1NucFdWM2hMVkRGYVZXSkZWbFZoTW1oNlZrWmtWMk15UlhwaFJsWm9UVlZ3V0Zkc1dsZE9SMDVYVTJ4c1dHRjZWbk5aVkVvelRXeGFSMkZJWkZaaVZrcFhWRlpTVDFWV1drVlJWR3M5 Vm0xMFlXSXlVWGxVYmtwT1ZteHdVVlpzV21GaU1WSlZVbTFHVmxKc1dsaFdWbWhyVlVaV1ZVMUVhejA9 Vm0weE1GVXhSWGhXV0doVVlteEtXRmxVUm5kVlJscDBaVWRHYVUxV1NsWlZiVEZIVm14S2MyTkdjRnBOUjAweFZrUkdTMk14VG5GU2JIQk9VbXhXTkZaclpEUlpWbHBZVTJ0YVYySkdXbTlVVnpGdlRsWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0= Vm0wd2VFMUhSWGROVldSWFYwZG9XVmx0ZUV0V01WbDNXa1pPVmxac2NEQmFWV1JIVmpGYWMySkVUbGROYWtaSVZteFZlRmRXUm5OaFJtUlhUVEpvVFZkV1VrSmxSbGw0Vkc1S2FsSnVRazlWYlhoMlpXeGFjbHBJY0d4U2EzQllWVEo0VjFaSFNrZGpTRUpXWVd0d2RscFdXbUZqYkdSMFpFWk9UbUY2VmpWV1JscGhWakZWZVZOclpGaGlSMmhXVm01d1YxUXhjRVZTYlVaVFRWaENTbGt3VlRWV01rVjZVV3h3VjFZemFIWmFSRVp6VmpGT2RWTnNVbWxTTVVwdlZtMXdUMkl4VFhoVmJGcFlZbFZhVkZscmFFTlRiR1J5VjJ4a2FGWnJjRmRaTUZwVFZqRmFWMk5HVG1GU1JWcEVWbGQ0UTFaVk1VVk5SREE5

the first sentence is "welcome" from base64 but if you try to decode any random part of the rest it doesn't give you anything.

Can someone help us? thanks!

Upvotes: 0

Views: 619

Answers (1)

wheeler
wheeler

Reputation: 3251

Formatted the question a little better:

  1. V2VsY29tZQ==

  2. VGxSTVRRPT0=

  3. VWtWTk5FOUVSVEJSZWxFd1RWVlpNRkpxWkVWUmExWkRUVVJWTTFGNlp6Vk9NRmw2VVZSS1IxRnFUWFpQVlVwRlRXdE5lbEV3UlhoUmFrMHhVbFJuZVUxclZrTlBSR3N4VG5wU1JrNTZhekZTVlZsM1RucG5QUT09

  4. V1RCak1XUXlVbGxUVjJScVlsVTFkbGx1YkVKbFJURkZVVmRrV2sweFJqUlVWVkpDWkZadmVXUkhORDA9

  5. Vmtab2QxVnJOVVpOV0VaWVYwWmFUMXBXVW01bFJsSllZMFphVGsxRVZsVlVhMmgzVkZkV2NrMVVWbFZOUmtwRFdsWldOR05XVGxsWGF6VnNZa1ZaTVZaR1ZrNU5SVEZ5WlVSYVdrMHpRbEJaVjNSV1pXeFNTR05GTld0aGVsWkdWMjV3UjFSWFJuTmlSRXBWVm14S2VWUlVRVEZXVmtaWlZtczVhRlpIWXpVPQ==

  6. Vm10U1IxVXhUblJXYmtwT1ZteGFVMVl3V21GVlJsWlpZMGMxYkZac1NucFdWM2hMVkRGYVZXSkZWbFZoTW1oNlZrWmtWMk15UlhwaFJsWm9UVlZ3V0Zkc1dsZE9SMDVYVTJ4c1dHRjZWbk5aVkVvelRXeGFSMkZJWkZaaVZrcFhWRlpTVDFWV1drVlJWR3M5

  7. Vm0xMFlXSXlVWGxVYmtwT1ZteHdVVlpzV21GaU1WSlZVbTFHVmxKc1dsaFdWbWhyVlVaV1ZVMUVhejA9

  8. Vm0weE1GVXhSWGhXV0doVVlteEtXRmxVUm5kVlJscDBaVWRHYVUxV1NsWlZiVEZIVm14S2MyTkdjRnBOUjAweFZrUkdTMk14VG5GU2JIQk9VbXhXTkZaclpEUlpWbHBZVTJ0YVYySkdXbTlVVnpGdlRsWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=

  9. Vm0wd2VFMUhSWGROVldSWFYwZG9XVmx0ZUV0V01WbDNXa1pPVmxac2NEQmFWV1JIVmpGYWMySkVUbGROYWtaSVZteFZlRmRXUm5OaFJtUlhUVEpvVFZkV1VrSmxSbGw0Vkc1S2FsSnVRazlWYlhoMlpXeGFjbHBJY0d4U2EzQllWVEo0VjFaSFNrZGpTRUpXWVd0d2RscFdXbUZqYkdSMFpFWk9UbUY2VmpWV1JscGhWakZWZVZOclpGaGlSMmhXVm01d1YxUXhjRVZTYlVaVFRWaENTbGt3VlRWV01rVjZVV3h3VjFZemFIWmFSRVp6VmpGT2RWTnNVbWxTTVVwdlZtMXdUMkl4VFhoVmJGcFlZbFZhVkZscmFFTlRiR1J5VjJ4a2FGWnJjRmRaTUZwVFZqRmFWMk5HVG1GU1JWcEVWbGQ0UTFaVk1VVk5SREE5

This is what I have so far (answer followed by steps to decode):

  1. Welcome (base64)

  2. NTLM (2x base64)

  3. DC8814C441F4F7DBEB057C897F3A2FB3/9BD2C3CA1B35E822EB89574E795EF078 (3x base64)

  4. cache epub 100 pg100.txt (4x base64 -> rot13)

  5. 34826.3/52575.3/32802.2/3420.6/73617.3/485.6/19750.6/ (5x base64)

  6. 92310.4/65498.2/65452.1/32334.3 (6x base64)

  7. 39589.4 (7x base64)

  8. 81159.5/17358.2 (8x base64)

  9. 45092.3.4/27310.3.2/68909.1.3 (9x base64)

Just some working thoughts:

  • #3 seems like it could be decoded further, perhaps it's two hex representations of ASCII or decimal separated by a /.
  • The numbers seems like either math or coordinates or something separated by /s.

Update:

  • #4 Appears to be a reference to a txt version of a book, specifically The Project Gutenberg EBook of The Complete Works of William Shakespeare. If you take #4 and google it, you should be able to find it. This leads me to believe that the rest of the numbers are encoded as line#.word#/line#.word#/...

  • As indicated by Thomas, the first part of line 3 refers to a word in this text file. Open it, perform a search for the first part of line 3, and next to it is the word Caesar, which is referring to the rot13 cipher being used in the following clue.

  • Those numbers are actually hashes of NTLM passwords. The solution for line 3 is caesar/thirteen does in fact refer to the rot13 simple cipher, which is used in the following clue.

Update 2:

Ok, if my theory above is true, then the lines 5 through 8 are:

  1. If/you/have/made/it/this/far

  2. then/We/congratulate/you

  3. regards

  4. team/Hydra

Line 9 was a little harder, as the last digit probably refers to the letter number in the word, so it could be translated as:

  1. P/w/C

Final update:

PwC probably refers to PricewaterhouseCoopers, which is a multinational consulting company. If you search team hydra pwc, you get some results that indicate an office of PwC in Hydra, Algeria.

Or, team hydra could refer to the Android hacking group.

Anything further is speculative.

Upvotes: 4

Related Questions