API tools faq
paste
Guest User

Untitled

a guest
Nov 3rd, 2014
2,907
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.61 KB | None | 0 0
raw download clone embed print report
  1. CICADA 3301 DISCOVERIES (solution - goo.gl/w2AHFf)
  2. ----------------------------------------------------------------------------------------------------------------------------------
  3. On May 2nd 2014 about 10:00 GMT, 3301 sent out messages to all hidden services previously registered on Onion 6. The requests made on the hidden services looked like this:
  4. 127.0.0.1 - - [02/May/2014:10:**:** +0200] "GET /key.asc HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 E Edition"PP
  5. 127.0.0.1 - - [02/May/2014:10:**:** +0200] "GET / HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 E Edition"
  6. 127.0.0.1 - - [02/May/2014:11:**:** +0200] "POST /cgi-bin/upload HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 S Edition"
  7. ----------------------------------------------------------------------------------------------------------------------------------
  8. 05/13/2014
  9. The message above is malformed. It was found that there are ascii spaces in the message (the last 31 have to be 37):
  10. <Totry> so anyway, that sequence - 2,3,5,7,11,13,17,23,29,31,31 - no-one have a clue why 19 is missing
  11. [...]
  12. <Totry> in the interests of moving things along....that sequence is written in ascii spaces (20) in the message
  13. [...]
  14. <nikkler> Hello.xxYourxenlightenmentxawaitsxyou.xx$
  15. <nikkler> xxx$
  16. <nikkler> xxxxxky2khlqdf7qdznac.onionxxxxxxx$
  17. <nikkler> xxxxxxxxxxx$
  18. <nikkler> Wexlookxforwardxtoxhearingxfromxyou.$
  19. <nikkler> xxxxxxxxxxxxx$
  20. <nikkler> xxxxxxxxxxxxxxxxx$
  21. <nikkler> Goodxluck.xxxxxxxxxxxxxxxxxxxxxxx$
  22. <nikkler> xxxxxxxxxxxxxxxxxxxxxxxxxxxxx$
  23. ----------------------------------------------------------------------------------------------------------------------------------
  24. Onion 7 - ky2khlqdf7qdznac.onion
  25. The onion from the message was running a thttpd server, version 2.25b. It was modified on April 2nd 08:33:19 GMT, meaning it took 3301 one month to set the website up and they let us wait another month before finally uploading a message. The page contained 58 images, all written in Runes and part of the Liber Primus as it seems.
  26. Header:
  27. Server: thttpd/2.25b 29dec2003
  28. Last-Modified: Wed, 02 Apr 2014 08:33:19 GMT
  29. Date: Fri, 02 May 2014 11:32:45 GMT
  30. Content-Type: text/html; charset=iso-8859-1
  31. Connection: close
  32. Accept-Ranges: bytes
  33. --------------------------------------------------------------------------------------------------------------------------------
  34. Source code:
  35. < html >
  36. < head >< title >133</ title ></ head >
  37. < body >
  38. < div id="331" >
  39. < img src="0.jpg" />< br />
  40. < img src="1.jpg" />< br />
  41. < img src="2.jpg" />< br />
  42. < img src="3.jpg" />< br />
  43. < img src="4.jpg" />< br />
  44. < img src="5.jpg" />< br />
  45. < img src="6.jpg" />< br />
  46. < img src="7.jpg" />< br />
  47. < img src="8.jpg" />< br />
  48. < img src="9.jpg" />< br />
  49. < img src="10.jpg" />< br />
  50. < img src="11.jpg" />< br />
  51. < img src="12.jpg" />< br />
  52. < img src="13.jpg" />< br />
  53. < img src="14.jpg" />< br />
  54. < img src="15.jpg" />< br />
  55. < img src="16.jpg" />< br />
  56. < img src="17.jpg" />< br />
  57. < img src="18.jpg" />< br />
  58. < img src="19.jpg" />< br />
  59. < img src="20.jpg" />< br />
  60. < img src="21.jpg" />< br />
  61. < img src="22.jpg" />< br />
  62. < img src="23.jpg" />< br />
  63. < img src="24.jpg" />< br />
  64. < img src="25.jpg" />< br />
  65. < img src="26.jpg" />< br />
  66. < img src="27.jpg" />< br />
  67. < img src="28.jpg" />< br />
  68. < img src="29.jpg" />< br />
  69. < img src="30.jpg" />< br />
  70. < img src="31.jpg" />< br />
  71. < img src="32.jpg" />< br />
  72. < img src="33.jpg" />< br />
  73. < img src="34.jpg" />< br />
  74. < img src="35.jpg" />< br />
  75. < img src="36.jpg" />< br />
  76. < img src="37.jpg" />< br />
  77. < img src="38.jpg" />< br />
  78. < img src="39.jpg" />< br />
  79. < img src="40.jpg" />< br />
  80. < img src="41.jpg" />< br />
  81. < img src="42.jpg" />< br />
  82. < img src="43.jpg" />< br />
  83. < img src="44.jpg" />< br />
  84. < img src="45.jpg" />< br />
  85. < img src="46.jpg" />< br />
  86. < img src="47.jpg" />< br />
  87. < img src="48.jpg" />< br />
  88. < img src="49.jpg" />< br />
  89. < img src="50.jpg" />< br />
  90. < img src="51.jpg" />< br />
  91. < img src="52.jpg" />< br />
  92. < img src="53.jpg" />< br />
  93. < img src="54.jpg" />< br />
  94. < img src="55.jpg" />< br />
  95. < img src="56.jpg" />< br />
  96. < img src="57.jpg" />< br />
  97. <a href="../htmls/01.html"><img src="../Z/01.jpg" border=0></a>
  98.  
  99. <a href="../htmls/02.html"><img src="../Z/02.jpg" border=0></a>
  100. <a href="../htmls/04.html"><img src="../Z/04.jpg" border=0></a>
  101. <a href="../htmls/05.html"><img src="../Z/05.jpg" border=0></a>
  102. <a href="../htmls/06.html"><img src="../Z/06.jpg" border=0></a>
  103.  
  104. </ div >
  105. </ body >
  106. </ html >background<red>
  107. --------------------------------------------------------------------------------------------------------------------------------
  108. The images from onion 7 can be found here ---> https://shadow-code.org/onion7.zip.
  109. Imgur gallery of all 58 new rune pages is here: http://imgur.com/a/8xnWx#0
  110. --------------------------------------------------------------------------------------------------------------------------------
  111. Requesting a non existent file resulted in a 404 page giving the port used by the server:
  112. Apache Server at 127.0.0.1 Port 5243
  113. --------------------------------------------------------------------------------------------------------------------------------
  114. Trying to connect to the server with telnet resulted in the following error:
  115. UNKNOWN 400 BaO'[d Request
  116. Server: thttpd/2.25b 29dec2003
  117. Content-Type: text/html; charset=iso-8859-1
  118. Date: Fri, 02 May 2014 11:46:39 GMT
  119. Last-Modified: Fri, 02 May 2014 11:46:39 GMT
  120. Accept-Ranges: bytes
  121. Connection: close
  122. Cache-Control: no-cache,no-store
  123.  
  124. <HTML>
  125. <HEAD><TITLE>400 Bad Request</TITLE></HEAD>
  126. <BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc">
  127. < H2>400 Bad Request< /H2>
  128. Your request has bad syntax or is inherently impossible to satisfy.
  129. < HR>
  130. <ADDRESS><A HREF="http://www.acme.com/software/thttpd/">thttpd/2.25b 29dec2003</A></ADDRESS>
  131. </BODY>
  132. </HTML>
  133. --------------------------------------------------------------------------------------------------------------------------------
  134. Page 15
  135. Page 15 contains the following matrix in ASCII:
  136. 3258 3222 3152 3038
  137. 3278 3299 3298 2838
  138. 3288 3294 3296 2472
  139. 4516 1206 708 1820
  140. --------------------------------------------------------------------------------------------------------------------------------
  141. This matrix can be generated with the following algorithm. Start from value 3299, and rotate outbound, starting clockwise.
  142. (3299 being the next smaller prime before 3301 and the numbers grow increasingly farther apart untill you get to 1206 and 4516, None of them prime... But, 4561 is prime and if you subtract 1260 from 4561 you get... 3301.)
  143. M(n) = abs( 3301 - P( F( n ) + 1 ) )
  144. Where P(x) is the X'th prime, and F(x) is the X'th Fibonacci number.
  145. --------------------------------------------------------------------------------------------------------------------------------
  146. Page 49,50,51
  147. These pages contain the following ASCII text:
  148. 3N 3p 2l 36 1b 3v 26 33 1W 49 2a 3g 47 04 33 3W 21 3M 0F 0X 1g 2H 0x 1R 1n 3I 2r 0P 2U 16 2L 2D 1t 1s 3H 0d 0s 1K 2D 05 1K 1O 0S 1D 3o 1l 3J 1G 4D 0G 0l 0x 1Q 2p 2a 1K 4E 1w 2Q 19 1k 3G 24 0p 22 4F 0P 3C 3J 1D 2n 1m 2i 1J 3P 2v 1s 2O 0k 1M 2M 0w 3L 3D 2r 0S 1p 15 3V 3e 3I 0n 3u 1O 0u 0Z 3g 2U 1C 0Y 1N 3n 0W 3Q 22 13 0V 3c 0E 34 0W 1t 1D 2N 3H 47 0s 2p 0Z 34 0g 3v 1Q 0s 0D 0K 2h 3D 3L 2x 1Q 20 2n 2L 1C 2p 0A 29 3r 0D 45 0k 2e 2W 25 3U 1W 2r 46 2s 2X 39 3p 0X 0E 1q 0q 4B 49 48 3r 3b 3C 1M 1j 0I 4A 48 40 3m 4E 0s 2S 1v 3T 0I 3t 2B 2k 2t 2O 0e 2l 1L 28 2a 0J 1L 0c 3C 2o 0X 00 2Z 2d 1T 2u 1t 1j 0l 1o 1E 3T 18 3E 1G 27 0L 0v 2t 06 11 1A 2U 4B 1O 2M 3d 2S 0x 0w 0q 0p 2V 18 0q 1D 49 2O 00 1v 2t 1k 3s 3G 21 3w 0W 29 2r 2O 2L 0g 3Y 0M 0u 3I 3C 1r 2c 2q 3o 30 0a 39 1K
  149. The first digit is always '0', '1', '2' or '3'. The last letter falls within '[0-9A-Za-x]', exactly 60 values. The maximum value is '4F'. This suggests a sexagesimal (base 60) counting system, where '4F' would correspond to '255'. The text can be rewritten in hexadecimal as follows:
  150. CBE7A7BA61ED7EB75CF99CDEF704B7D479CA0F2166893B576DC6AD1996428D857372C5273650850550541C49E66BC74CFD102F3B56AB9C50FE7692456AC47C337AFF19C0C749A96CA44FCDB172902E528E3AC9C1AD1C6F41D3DCC631EC543823DE96482253E520CE7A3F1FDA0EB82073498FC5F736AB23B82AED56360D14A3C1C9B35678A98D48AB0A81E90DF52EA0987DD25CADF6AE99BDE7210E7034FBF9F8E9D9C0526912FAF8F0E4FE369475D112EB83A6AF9028A751809C135126C0AA21009B9F59B073692F6E4AD144C24C7F1539AF063D4696FB548EDB943B3A343397443449F9900075AF6AEAC479EE2081AD908D2AD61638C6C0719EACE6B424BD50
  151. Page 33 to 39 contain a hint in the form of Cuneiform numbers. These represent the numbers '17' '13' '55' and '1'. In base 60: 17*60+13 = 1033 and 55*60+1 = 3301
  152. --------------------------------------------------------------------------------------------------------------------------------
  153. Page 49 contains:
  154. 3N 3p 2l 36 1b 3v 26 33
  155. 1W 49 2a 3g 47 04 33 3W
  156. 21 3M 0F 0X 1g 2H 0x 1R
  157. 1n 3i 2r 0P 2U 16 2L 2D
  158. 1t 1s 3H 0d 0s 1K 2D 05
  159. 1K 1O 0S 1D 3o 1L 3J 1G
  160. 4D 0G 0L 0x 1Q 2p 2a 1K
  161. 4E 1w 2Q 19 1k 3G 24 0p
  162. 22 4F 0P 3C 3J 1D 2n 1m
  163. 2i 1J 3P 2v 1s 2O 0k 1M
  164. --------------------------------------------------------------------------------------------------------------------------------
  165. Page 50 contains:
  166. 2M 0w 3L 3D 2r 0S 1p 15
  167. 3V 3e 3I 0n 3u 1O 0u 0Z
  168. 3g 2U 1C 0Y 1N 3n 0W 3Q
  169. 22 13 0V 3c 0E 34 0W 1t
  170. 1D 2N 3H 47 0s 2p 0Z 34
  171. 0g 3v 1Q 0s 0D 0K 2h 3D
  172. 3L 2x 1Q 20 2n 2L 1C 2p
  173. 0A 29 3r 0D 45 0k 2e 2W
  174. 25 3U 1W 2r 46 2s 2X 39
  175. 3p 0X 0E 1q 0q 4B 49 48
  176. 3r 3b 3C 1M 1j 0l 4A 48
  177. 40 3m 3E 0s 2s 1v 3T 0i
  178. 3t 2B 2k 2t 2O 0e 2L 1L
  179. --------------------------------------------------------------------------------------------------------------------------------
  180. Page 51 contains:
  181. 28 2a 0J 1L 0c 3C 2o 0X
  182. 00 2Z 2d 1T 2u 1t 1j 0L
  183. 1o 1E 3T 18 3E 1G 27 0L
  184. 0v 2t 06 11 1A 2U 4B 1O
  185. 2M 3d 2S 0x 0w 0q 0p 2V
  186. 18 0q 1D 49 2O 00 1v 2t
  187. 1k 3s 3G 21 3w 0W 29 2r
  188. 2O 2L 0g 3Y 0M 0u 3i 3C
  189. 1r 2c 2q 3o 30 0a 39 1K
  190. --------------------------------------------------------------------------------------------------------------------------------
  191. Page 56
  192. Take the runes on page 56 (http://imgur.com/a/8xnWx#56) and encode them to numbers 0 to 28. Shift them with a stream of (prime numbers, modulo 29) -1, then the runes decode to:
  193. AN END. WITHIN THE DEEP WEB TH
  194.  
  195. ERE EXISTS A PAGE THAT HA
  196.  
  197. SHES TO:
  198. 36367763ab73783c7af284446c
  199. 59466b4cd653239a311cb7116
  200. d4618dee09a8425893dc7500b
  201. 464fdaf1672d7bef5e891c6e227
  202. 4568926a49fb4f45132c2a8b4
  203. IT IS THE DUTY OF EUERY PILGR
  204. IM TO SEEK OUT THIS PAGE.
  205. This can be interpreted as the hash of an onion page.
  206. --------------------------------------------------------------------------------------------------------------------------------
  207. Page 57
  208. Page 57 (http://imgur.com/a/8xnWx#57) contains the following text in unencrypted runes:
  209. Parable : like the instar tunneling to the surface.
  210. We must shed our own circumferences. Find the
  211. divinity within and emerge.
  212. This parable appeared in 2013.
  213. 0421812877725. (scanned from mayfly, most likely redlaser glitch)
  214. digits are most likely glitch with red laser. Saved just in case.
  215. --------------------------------------------------------------------------------------------------------------------------------
  216. Symbols from onion 7
  217. Here is archive of /x/ thread
  218. http://archive.4plebs.org/x/thread/14547165
  219. --------------------------------------------------------------------------------------------------------------------------------
  220. We figured out so far that: cuneiform means indeed 1033 3301 (see above)
  221. It's Babylonian and Babylonians had sexagesimal numeral system.
  222. Probably a hint to base60.
  223. The blurred tree-like thing is a dendrite.
  224. Celery-like thing on the right site of the picture probably is a dendrite too.
  225. The two flies in the centre are mayflies.no.
  226. The fly in the top left is an Ephemeridae.
  227. Update
  228. There are 58 pages in total, labled 0-57. 57 is the most accurate integer that can be squared to reach a number closest to 3301. It cannot be a coincidence.
  229. This leads me to believe that the page number is extremely relevant to solving the next stage of this puzzle. Seeing as page 57 is unencrypted, I believe that we are looking for an encryption where the page number (x) can be substituted with 57 (or 58) to equal 0, since the 57th (or possibly 58th if you count the number of pictures) runic page is unencrypted.
  230. Calculating the number 3301 in Base58 gives "ur," which is a Sumerian city. This supports the idea of Cuneiform, and also adds the possibility of x being 58.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!