I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out.

So I have the encrypted cookie (AES_CBC):

5468697320697320616e204956343536 d6ca0a2883280762915414c54e97df1b 40871b72f45ec7f9510a080095436d51 4129e137aaac86a0f7fa8bd3d250b9d1 df35b668fcb93f00bb06692560a3fed8 a3b523d385f1477b6daac14ff2416c67

which I could decrypt with the padding oracle to:

hex: 5468697320697320616e204956343536 7b22757365726e616d65223a20226775 657374222c202265787069726573223a 2022323030302d30312d3037222c2022 69735f61646d696e223a202266616c73 65227d0d0d0d0d0d0d0d0d0d0d0d0d0d
ASCII: This is an IV456{"username": "guest", "expires": "2000-01-07", "is_admin": "false"}

I now have to change the cookie date so it is not expired and I also have to change is_admin to true. So first I wanted to change the year in the date to 3000 to only have to change one number.

The expiry year is part of the 4th plaintext block, byte 3: P_43
The corresponding encrypted ciphertext block byte will be defined as: C_43
The manipulated plaintext byte will be defined as: P_43'
The corresponding ciphertext byte will be defined as: C_43'
The bytes from other blocks will have the same definition [cipher=C or plain=P]_[block][byte]

Since I want to change the number 2, I know that P_43=32 (ascii to hex).
In addition I know that I want to change the plaintext to show the number 3 so P_43'=33
Looking at the ciphertext I can also see that C_43=e1 and C_33=1b

So what I already tried, is the following:
Calculate C_33' = (P_43') xor (P_43) xor (C_33) = 33 xor 32 xor 1b = 1a and change C_33 to C_33' = 1a

Since it did not work I also tried some other stuff (which made no sense for me) I read in the forums like:
C_43' = (P_43') xor (P_43) xor (C_43) = 33 xor 32 xor e1 = e0 or
C_33' = (P_43') xor (C_33)

Can someone please explain me what I am doing wrong? I wrote my own padding oracle script based on the blog post about it and I successfully decrypted the message but I really don't know what I am doing wrong here.

  • $\begingroup$ As the entire block of which you do the XOR changes if you try and change the ciphertext, I don't see how you could be doing this. Are you sure this is a question that was asked of you? $\endgroup$
    – Maarten Bodewes
    Commented Apr 17, 2019 at 16:28
  • $\begingroup$ @Maarten Bodewes Are you sure that this is the reason why it not works? Looking at the equations C_N=E(P_N xor C_N-1) and P_N'=D(C_N) xor C_N-1' and inserting the first one in the second on leads to P_N'=D(E(P_N xor C_N-1)) xor C_N-1' = P_N'=P_N xor C_N-1 xor C_N-1'. And then I only transformed the equation so that I have C_N-1'. Am I missing something here? $\endgroup$
    – Loeli
    Commented Apr 19, 2019 at 3:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.