How I decrypted XECryption with Excel

Madderc · 05-08-2013, 11:09 PM

Introduction

NOTE: This is a tutorial about a manual decryption, as if you didn't know how the encryption worked and etc, but you'll see that...

Ok so lately I've been doing www.hackthissite.org missions, and a few day ago I finished realistic mission 6, which the goal was to decrypt a message.

As such, I will try to divide this guide into steps, so that if you are trying to complete the challenge but only want tips and not the actual solution... because remember, if you want to learn, you have to do as much as you can by yourself, but it's ok to ask for help sometimes Biggrin

Anyway, onward to the actual thing

The mission

Your "client" which is apparently an employee of a chemical corporation is suspicious that the chemicals produced from it are polluting the environment heavily, however the health inspectors say there's nothing wrong, being suspicious that something was fishy, he started sniffing his CEO's packages, he managed to recover a message, but it was encrypted... and that's where you come in.

What is given to you from the very beginning is the encrypted message and the tool that's used to encrypt it, which is XECryption.

The message is a huge string of numbers separated by dots.

Spoiler: Here's a bit of that messageCode:
.296.294.255.268.313.278.311.270.290.305.322.252.276.286.301.305.264.301.251.269.274.311.304. 230.280.264.327.301.301.265.287.285.306.265.282.319.235.262.278.249.239.284.237.249.289.250. 282.240.256.287.303.310.(etc.)

So what do we do first?

Spoiler: Figuring out how the encryption works

Figuring out how the encryption works

So the first thing we have to do, is try and figure out how the encryption works, so what can we do?

After clicking the link to the Encryption page you are presented with this:

Spoiler: Encryption page:

Well, if we don't do anything we can't hope to figure it out right?

So I typed an 'a' in the input box and left the password blank.

It generated 3 numbers in the following format .XX.XX.XX, the numbers could be negative, positive, low or high.
After generating an encryption more times with the same character I noticed that the numbers were constantly different, but it seemed like if a number was too big, the others were too low or even negative...

So I decided to add the 3 numbers and see what I got, I got a 97, so I went to http://www.asciitable.com/

Spoiler: Here's the image if you're to lazy to go to another webpage:

And what's the Dec value for 'a'? Oh look at that, it's 97!

So we now know that the encryption generates 3 numbers that when added give you the Dec value of the character you typed.

But what if you type more characters than 1? Try it, if you put 2 'a''s you'll see 6 numbers and so on according to the amount of characters you input.

Great so the encryption is constant even if you type even more characters Biggrin

So what now? We know how it works without a password... How are we going to find how the password affects the encryption?

Spoiler: Figuring out what the password does

Figuring out what the password does

Well, let's use our control char once more, which, in my case, is 'a'.

Ok so an 'a' will generate 3 numbers that add to 97 without the password, great...

Let's see what happens if we use 'a' as the password as well.

It generates 3 numbers but they appear much higher... what if we add them though?

Why it's 194! This should be a no-brainer, 97 + 97 = 194 right?

So now we fully understand how the encryption works! And we found it all by ourselves! Aren't we proud! Biggrin

Well that still won't do us much good, we know how it works... but how do we solve it now?

We could always add every number manually but that would take us forever! D:

That's when Excel comes in! Smile

BUT FIRST!

Spoiler: Preparing the message for Excel

Preparing the message for Excel

Well, before actually going to excel, first we should "prepare" our message a bit right?

Here's what I did, and yes, for some reason I wanted to do it the hard way and did the whole thing manually using only the notepad, I even thought about creating a C++ program to do it for me but nah, didn't feel like it.

So what I did (and feel free to do anything you want) was first I pasted the whole message in notepad, used the "replace" tool to replace every '.' with ' ' (space).

Then, armed with the power of the arrow keys, backspace and enter, I started creating paragraphs 3 by 3.

Spoiler: Like this:

PS: If you're REALLY going to do it this way, at least have the cleverness to just press left, down and enter, don't move all the way Tongue

Phew finally it was done and took WAY longer than expected, but still it wasn't that long, pretty doable actually, so now that we have our code prepared, we are ready to...

Spoiler: Move onto Excel

Moving onto Excel

Why did we do all that in notepad a step before you ask?

So it's easier to use it in Excel that's why! Tongue

Now all we have to do is copy the numbers, and since they are already divided into 3 rows, you paste in the A1 cell and it should automatically divide them into cells from A1 to C1 and all the way down till the end. If it doesn't just go to "Data" options and fiddle around with it a bit, mine didn't work at first for some reason, but it should't be hard ;P

And what now?

Now we start using Excel codes to help us Biggrin

2 Cells to the right I used the SUM command to add the 3 cells of that line, like this:

Code:
=SUM(A1:C1)

Spoiler: Image

Then hover the mouse to the lower right of that cell, until a black + appears as the cursor and drag all the way down until the last line of numbers, this copies the code from cell to cell taking into account the movement, in other words, if you copy a code that affects lines A1 to C1, and copy it down to the 4th line, it will automatically change to ...(A4:C4) Biggrin

Oh yes! Now we have all the actual values of the message! (plus the password)

Now lets find out the password's value shall we? Biggrin

Spoiler: Finding out the password's value

Finding out the password's value

We aren't going to find out the password, but why do we want to anyway? We just need it's value right? Right, let's do it then.

Now we have the actual values of the whole code... great, but how do we exactly find out what's the password's value? The max value for the Dec values is 255 and I'm pretty sure 800 is way higher than that!

Of course it is, it still has the password, so let's find it now.

So what I did now, I went to a few cells under the actual values and used the

Code:
=MODE(E1:E366)

code to find out which number had the most occurrences

(No image since it's pretty simple)

And I got the number: 794

... Ok we have the number that's there the most so... What is it?

Well, when you write a text, specially the longer the text is, what is the character that should appear more than any other?

Spoiler: WHAT IS IT?! PLEASE DO TELL! I CAN'T LIVE IF YOU DON'T!!! D:

SPACE!

Exactly, so all we need to do now is find what Dec value that character has shall we?

It's 32! So now that we have the total number of a character very likely to be 'Space', which is 794, and know that it's actual value is 32... how do we find the password with it?

Just subtract the actual value from the value WITH the password, which means, 794 - 32 = 762!

Hell yeah! Now we have the password's value! We're almost done decrypting the text Biggrin

Spoiler: FINDING THE TRUTH!

FINDING THE TRUTH!

This is it, the last step towards decrypting the message, and we did it all manually, aren't you proud? Biggrin

Anyway, now we just need to subtract the password from the numbers, again I did it 2 rows to the right of the numbers, and yes, you can use the "SUM" command for this one as well Tongue

Like this:

Code:
=SUM(E1; -762)

Drag the code all the way down and BAM! We have got ourselves all the Dec values of every char in the message! Biggrin

(we think...)

Just bare with me for a second and I'll tell you how to fine tune it in case it doesn't work well.

Now we just need to copy all the cells, after this one could:

A) Translate every letter by hand;
B) Create a program to turn every input into an ASCII char;
C) Get lazy and google a converter Biggrin

I chose C) for my last step, I used http://home.paulschou.net/tools/xlate/, it lets you encode and decode many kinds of texts to many other kinds at the same time, neat Biggrin

Now just paste those values into the [ ASCII DEC / CHAR ] box and press decode...

Under the [ TEXT ] box your text should be there as clear as day Biggrin

How do I know if I did it right? I mean, what if space wasn't the most used character?

Well, knowing if you did it right or not is the easiest part, if the text makes no sense, there is an incredibly high chance that "space" was NOT the most used value right?

But even so it's still pretty easy to find the password, scour your numbers, or just use the

Code:
=MIN(...)

function of excel to find out which of them is the lowest, if it's a long text, it should still be space, because the chars before space are special characters, however, in this case, and it should also be quite common in many other cases, look at char 10...

New Line, which means if there are paragraphs, that should be the lowest number you will get (that's the lowest number I get on that message at least), if that's the case, just subtract 10 to that number, assume that's the password, subtract it to every number, and see if the message now makes sense.

There is also the chance that it could be the Horizontal Tab to be the lowest number, in that case just subtract 9

If that still doesn't work, use your head a little Biggrin

Try to think of ways to find out one particular character, be creative, think outside the box!

Spoiler: Conclusion

Conclusion!

And that concludes my tutorial on how I decrypted a XECryption text using excel and a bit of manual work Smile

I made this guide mainly to remind you of a few things:

- You can and SHOULD think outside the box!;
- Don't stop thinking and finding creative ways to reach your goal;
- Keep calm and examine what you're given;
- Mess around with stuff, find out how it works, and start wondering how to reverse it;
- Google if you really need to Tongue

- Don't look for thing to do the whole work for you, but you can always look for some that will help you get closer or take shortcuts Smile

And last but most importantly, memorize this acronym which has been with me for years and I still consider it to be one of the most important pieces of wisdom I have ever received and that can be used on anything in life:

KISS!

Keep
It
Simple
Stupid

And yes, I do keep forgetting that acronym, but believe me, if you live by it, your life will go much smoother and everything you make will always turn out neater than it would Biggrin

Thank you all for reading, if you have any suggestions please do tell ^^

Madderc · 05-08-2013, 11:09 PM

Introduction

NOTE: This is a tutorial about a manual decryption, as if you didn't know how the encryption worked and etc, but you'll see that...

Ok so lately I've been doing www.hackthissite.org missions, and a few day ago I finished realistic mission 6, which the goal was to decrypt a message.

As such, I will try to divide this guide into steps, so that if you are trying to complete the challenge but only want tips and not the actual solution... because remember, if you want to learn, you have to do as much as you can by yourself, but it's ok to ask for help sometimes Biggrin

Anyway, onward to the actual thing

The mission

Your "client" which is apparently an employee of a chemical corporation is suspicious that the chemicals produced from it are polluting the environment heavily, however the health inspectors say there's nothing wrong, being suspicious that something was fishy, he started sniffing his CEO's packages, he managed to recover a message, but it was encrypted... and that's where you come in.

What is given to you from the very beginning is the encrypted message and the tool that's used to encrypt it, which is XECryption.

The message is a huge string of numbers separated by dots.

Spoiler: Here's a bit of that messageCode:
.296.294.255.268.313.278.311.270.290.305.322.252.276.286.301.305.264.301.251.269.274.311.304. 230.280.264.327.301.301.265.287.285.306.265.282.319.235.262.278.249.239.284.237.249.289.250. 282.240.256.287.303.310.(etc.)

So what do we do first?

Spoiler: Figuring out how the encryption works

Figuring out how the encryption works

So the first thing we have to do, is try and figure out how the encryption works, so what can we do?

After clicking the link to the Encryption page you are presented with this:

Spoiler: Encryption page:

Well, if we don't do anything we can't hope to figure it out right?

So I typed an 'a' in the input box and left the password blank.

It generated 3 numbers in the following format .XX.XX.XX, the numbers could be negative, positive, low or high.
After generating an encryption more times with the same character I noticed that the numbers were constantly different, but it seemed like if a number was too big, the others were too low or even negative...

So I decided to add the 3 numbers and see what I got, I got a 97, so I went to http://www.asciitable.com/

Spoiler: Here's the image if you're to lazy to go to another webpage:

And what's the Dec value for 'a'? Oh look at that, it's 97!

So we now know that the encryption generates 3 numbers that when added give you the Dec value of the character you typed.

But what if you type more characters than 1? Try it, if you put 2 'a''s you'll see 6 numbers and so on according to the amount of characters you input.

Great so the encryption is constant even if you type even more characters Biggrin

So what now? We know how it works without a password... How are we going to find how the password affects the encryption?

Spoiler: Figuring out what the password does

Figuring out what the password does

Well, let's use our control char once more, which, in my case, is 'a'.

Ok so an 'a' will generate 3 numbers that add to 97 without the password, great...

Let's see what happens if we use 'a' as the password as well.

It generates 3 numbers but they appear much higher... what if we add them though?

Why it's 194! This should be a no-brainer, 97 + 97 = 194 right?

So now we fully understand how the encryption works! And we found it all by ourselves! Aren't we proud! Biggrin

Well that still won't do us much good, we know how it works... but how do we solve it now?

We could always add every number manually but that would take us forever! D:

That's when Excel comes in! Smile

BUT FIRST!

Spoiler: Preparing the message for Excel

Preparing the message for Excel

Well, before actually going to excel, first we should "prepare" our message a bit right?

Here's what I did, and yes, for some reason I wanted to do it the hard way and did the whole thing manually using only the notepad, I even thought about creating a C++ program to do it for me but nah, didn't feel like it.

So what I did (and feel free to do anything you want) was first I pasted the whole message in notepad, used the "replace" tool to replace every '.' with ' ' (space).

Then, armed with the power of the arrow keys, backspace and enter, I started creating paragraphs 3 by 3.

Spoiler: Like this:

PS: If you're REALLY going to do it this way, at least have the cleverness to just press left, down and enter, don't move all the way Tongue

Phew finally it was done and took WAY longer than expected, but still it wasn't that long, pretty doable actually, so now that we have our code prepared, we are ready to...

Spoiler: Move onto Excel

Moving onto Excel

Why did we do all that in notepad a step before you ask?

So it's easier to use it in Excel that's why! Tongue

Now all we have to do is copy the numbers, and since they are already divided into 3 rows, you paste in the A1 cell and it should automatically divide them into cells from A1 to C1 and all the way down till the end. If it doesn't just go to "Data" options and fiddle around with it a bit, mine didn't work at first for some reason, but it should't be hard ;P

And what now?

Now we start using Excel codes to help us Biggrin

2 Cells to the right I used the SUM command to add the 3 cells of that line, like this:

Code:
=SUM(A1:C1)

Spoiler: Image

Then hover the mouse to the lower right of that cell, until a black + appears as the cursor and drag all the way down until the last line of numbers, this copies the code from cell to cell taking into account the movement, in other words, if you copy a code that affects lines A1 to C1, and copy it down to the 4th line, it will automatically change to ...(A4:C4) Biggrin

Oh yes! Now we have all the actual values of the message! (plus the password)

Now lets find out the password's value shall we? Biggrin

Spoiler: Finding out the password's value

Finding out the password's value

We aren't going to find out the password, but why do we want to anyway? We just need it's value right? Right, let's do it then.

Now we have the actual values of the whole code... great, but how do we exactly find out what's the password's value? The max value for the Dec values is 255 and I'm pretty sure 800 is way higher than that!

Of course it is, it still has the password, so let's find it now.

So what I did now, I went to a few cells under the actual values and used the

Code:
=MODE(E1:E366)

code to find out which number had the most occurrences

(No image since it's pretty simple)

And I got the number: 794

... Ok we have the number that's there the most so... What is it?

Well, when you write a text, specially the longer the text is, what is the character that should appear more than any other?

Spoiler: WHAT IS IT?! PLEASE DO TELL! I CAN'T LIVE IF YOU DON'T!!! D:

SPACE!

Exactly, so all we need to do now is find what Dec value that character has shall we?

It's 32! So now that we have the total number of a character very likely to be 'Space', which is 794, and know that it's actual value is 32... how do we find the password with it?

Just subtract the actual value from the value WITH the password, which means, 794 - 32 = 762!

Hell yeah! Now we have the password's value! We're almost done decrypting the text Biggrin

Spoiler: FINDING THE TRUTH!

FINDING THE TRUTH!

This is it, the last step towards decrypting the message, and we did it all manually, aren't you proud? Biggrin

Anyway, now we just need to subtract the password from the numbers, again I did it 2 rows to the right of the numbers, and yes, you can use the "SUM" command for this one as well Tongue

Like this:

Code:
=SUM(E1; -762)

Drag the code all the way down and BAM! We have got ourselves all the Dec values of every char in the message! Biggrin

(we think...)

Just bare with me for a second and I'll tell you how to fine tune it in case it doesn't work well.

Now we just need to copy all the cells, after this one could:

A) Translate every letter by hand;
B) Create a program to turn every input into an ASCII char;
C) Get lazy and google a converter Biggrin

I chose C) for my last step, I used http://home.paulschou.net/tools/xlate/, it lets you encode and decode many kinds of texts to many other kinds at the same time, neat Biggrin

Now just paste those values into the [ ASCII DEC / CHAR ] box and press decode...

Under the [ TEXT ] box your text should be there as clear as day Biggrin

How do I know if I did it right? I mean, what if space wasn't the most used character?

Well, knowing if you did it right or not is the easiest part, if the text makes no sense, there is an incredibly high chance that "space" was NOT the most used value right?

But even so it's still pretty easy to find the password, scour your numbers, or just use the

Code:
=MIN(...)

function of excel to find out which of them is the lowest, if it's a long text, it should still be space, because the chars before space are special characters, however, in this case, and it should also be quite common in many other cases, look at char 10...

New Line, which means if there are paragraphs, that should be the lowest number you will get (that's the lowest number I get on that message at least), if that's the case, just subtract 10 to that number, assume that's the password, subtract it to every number, and see if the message now makes sense.

There is also the chance that it could be the Horizontal Tab to be the lowest number, in that case just subtract 9

If that still doesn't work, use your head a little Biggrin

Try to think of ways to find out one particular character, be creative, think outside the box!

Spoiler: Conclusion

Conclusion!

And that concludes my tutorial on how I decrypted a XECryption text using excel and a bit of manual work Smile

I made this guide mainly to remind you of a few things:

- You can and SHOULD think outside the box!;
- Don't stop thinking and finding creative ways to reach your goal;
- Keep calm and examine what you're given;
- Mess around with stuff, find out how it works, and start wondering how to reverse it;
- Google if you really need to Tongue

- Don't look for thing to do the whole work for you, but you can always look for some that will help you get closer or take shortcuts Smile

And last but most importantly, memorize this acronym which has been with me for years and I still consider it to be one of the most important pieces of wisdom I have ever received and that can be used on anything in life:

KISS!

Keep
It
Simple
Stupid

And yes, I do keep forgetting that acronym, but believe me, if you live by it, your life will go much smoother and everything you make will always turn out neater than it would Biggrin

Thank you all for reading, if you have any suggestions please do tell ^^