This is Oxford's computer security exam question:
Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a public RSA verification key $kv$ (retaining in secret the corresponding signing key $ks$). Alice wants to send an integrity protected and confidential message $m$ to Bob by transmitting the pair:
Bob will perform the obvious decryption and verification, rejecting messages which are
incorrectly signed or have incorrect padding.
However, Alice and Bob use defective padding schemes. The encryption process RSA encrypts
the byte string ‘padding 00 message’, where "padding" contains random nonzero
bytes, 00 indicates a single zero byte, and message is the intended message (which is
assumed to fit within the RSA modulus). The signature process RSA-signs the byte string
‘01 01 message’ (and again the message is assumed to fit within the modulus in this
Greedy is an active attacker who intercepts Alice’s communication to Bob. He knows that the message contains a sum of money which is to be transferred by Bob (a bank) to Greedy himself. Show how Greedy can tamper with Alice’s message to give himself a non-negligible chance of getting very rich.
I have read RSA Encryption and Signature - Weak Padding but the attack found in that question can not control the content of $m$. Can anyone show me how to answer this question?