# AES-CBC ciphertext manipulation with known IV and plaintext! [duplicate]

I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin", "username", "password". The admin field is set to 0, and the user/pass fields accepts anything. To login, I have to change this ciphertext such that the admin field is set to 1 when decrypted.

The encryption function works like this:

• A raw string is padded, then encrypted with AES-CBC and a random IV.
• Then, this cipher text appends the IV (concatenation; IV+cipher).
• Then, this is Base64 encoded, and returned.

So, to decrypt, we simply decode it with Base64, and split the result so that the 16 first characters are the IV, and the remaining is the ciphertext.

Now, I want to know the ciphertext when one character of the plaintext is changed.

Specifically, in my example:

The following string is encrypted, appended to the IV, and encoded:

This apparently results in the encoded text (found in cookie):

yMqlNejXMclgcU5+wbL40RY/mvIMW+AvguoMvCv0NemhRYzWzs7EQ2DXpvwsGmFynGpNWNyotYBea+P3Z3XZIvMBoMzdMVb/FtWQ+GV/MmA=

It appears the key is fixed, but the IV is generated at random every time I try to logout and login again.

Is this possible? If so, how?

Thanks!

## marked as duplicate by Maeher, Maarten Bodewes♦Jan 29 at 1:17

• Even without MAC authentication tag you couldn't change the ciphertext without rendering the token corrupt because AES-CBC isn't a stream cipher. – DannyNiu Jan 25 at 6:14
• Hint: how is the IV used during decryption? Check the cipher modes of operation page on Wikipedia. – Maarten Bodewes Jan 25 at 6:31
• You might also look at Bit Flipping Attack on CBC Mode – kelalaka Jan 26 at 13:48
• @kelalaka Thanks! That was exactly what I was thinking of, but for some reason it didn't "click in" until you wrote it out loud. Solved the problem by decoding the Base64 to hex, flip the bit in question, and re-encode it to Base64. Worked like a charm. :-) – sp4rr0w Jan 27 at 0:52

Because in CBC, $$C_i = E_k(C_{i-1} \oplus P_i)$$, and $$C_0 = IV$$, you can alter any bit in the first block by changing $$IV$$ without affecting later blocks and won't get caught because there isn't a MAC tag.