Anyways, it is 128 bit CBC. I incorrectly assumed 256 bit because I forgot the hex representation of a char is twice the length. Since they don't have a padding block, the shortest possible output is one block. Thus 16 bytes or a hex string of 32 characters in length.
Jesus Christ that's incompetent. I see what you mean, it's 32 hex chars, not binary chars. Since we have the IV and key, we can just decrypt all the passwords.
