0
$\begingroup$

I know this is a kind of a very un-specific question. But I cannot figure it out where I am doing it wrong implementing an Oracle Padding attack.

So What I'm supposed to do is to send a iv || ciphertext, and the server will decrypt it and unpad it and see if it matches with the provided sentence. (The server displays a random sentence, and Sentence length is 24 < len(quote) < 32, so I guess what I should send to the server - it should be in the form "iv || cp(ciphertext)1 || cp2")

Crypto.Cipher AES is used and it is in CBC.mode. and PKCS #7.

What I did:

Step 1. first set cp2 to random text like "ddddd...." ("d" * 32), set iv to random text like "00000..." ("0" * 32) And by brute forcing cp1 using from padding 0x01 ~ 0x10 (16 bytes), I got intermediary value of cp1, let's call this intermediary[1].

Step 2. And then i got rid of cp2 to get IV xor Plaintext[0]. (I just sent IV || cp1) Call cp1 value that satisfied "Wrong Data, but correct padding" when padding = 16(\0x10\0x10....) in step1, as "cp1_."

I sent to server with 0* 32 + cp1_. where I changed 0*32 part in brute forcing, to change padding from 0x01 ~ 0x10, to get IV xor Plaintext[0], now let's call this intermediary[0].

Then I did xor Intermediary[0], and Intermediary[1] with corresponding letter of the quote till the quote length, and the elements left in Intermediary[1], I did xor with the padding necessary.

Step 3. I sent to the server the result of the above computation + "d" * 32.

Appearantly, server is returning "wrong data, but correct padding." And I cannot figure out what I did wrong.

I apologize for the vagueness the question is presenting. thanks in advance.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.