I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out.

So I have the encrypted cookie (AES_CBC):

5468697320697320616e204956343536 d6ca0a2883280762915414c54e97df1b 40871b72f45ec7f9510a080095436d51 4129e137aaac86a0f7fa8bd3d250b9d1 df35b668fcb93f00bb06692560a3fed8 a3b523d385f1477b6daac14ff2416c67

which I could decrypt with the padding oracle to:

hex: 5468697320697320616e204956343536 7b22757365726e616d65223a20226775 657374222c202265787069726573223a 2022323030302d30312d3037222c2022 69735f61646d696e223a202266616c73 65227d0d0d0d0d0d0d0d0d0d0d0d0d0d
ASCII: This is an IV456{"username": "guest", "expires": "2000-01-07", "is_admin": "false"}

I now have to change the cookie date so it is not expired and I also have to change is_admin to true. So first I wanted to change the year in the date to 3000 to only have to change one number.

The expiry year is part of the 4th plaintext block, byte 3: P_43
The corresponding encrypted ciphertext block byte will be defined as: C_43
The manipulated plaintext byte will be defined as: P_43'
The corresponding ciphertext byte will be defined as: C_43'
The bytes from other blocks will have the same definition [cipher=C or plain=P]_[block][byte]

Since I want to change the number 2, I know that P_43=32 (ascii to hex).
In addition I know that I want to change the plaintext to show the number 3 so P_43'=33
Looking at the ciphertext I can also see that C_43=e1 and C_33=1b

So what I already tried, is the following:
Calculate C_33' = (P_43') xor (P_43) xor (C_33) = 33 xor 32 xor 1b = 1a and change C_33 to C_33' = 1a

Since it did not work I also tried some other stuff (which made no sense for me) I read in the forums like:
C_43' = (P_43') xor (P_43) xor (C_43) = 33 xor 32 xor e1 = e0 or
C_33' = (P_43') xor (C_33)

Can someone please explain me what I am doing wrong? I wrote my own padding oracle script based on the blog post about it and I successfully decrypted the message but I really don't know what I am doing wrong here.

  • $\begingroup$ As the entire block of which you do the XOR changes if you try and change the ciphertext, I don't see how you could be doing this. Are you sure this is a question that was asked of you? $\endgroup$ – Maarten Bodewes Apr 17 '19 at 16:28
  • $\begingroup$ @Maarten Bodewes Are you sure that this is the reason why it not works? Looking at the equations C_N=E(P_N xor C_N-1) and P_N'=D(C_N) xor C_N-1' and inserting the first one in the second on leads to P_N'=D(E(P_N xor C_N-1)) xor C_N-1' = P_N'=P_N xor C_N-1 xor C_N-1'. And then I only transformed the equation so that I have C_N-1'. Am I missing something here? $\endgroup$ – Loeli Apr 19 '19 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.