I know this is a kind of a very un-specific question. But I cannot figure it out where I am doing it wrong implementing an Oracle Padding attack.

So What I'm supposed to do is to send a iv || ciphertext, and the server will decrypt it and unpad it and see if it matches with the provided sentence. (The server displays a random sentence, and Sentence length is 24 < len(quote) < 32, so I guess what I should send to the server - it should be in the form "iv || cp(ciphertext)1 || cp2")

Crypto.Cipher AES is used and it is in CBC.mode. and PKCS #7.

What I did:

Step 1. first set cp2 to random text like "ddddd...." ("d" * 32), set iv to random text like "00000..." ("0" * 32) And by brute forcing cp1 using from padding 0x01 ~ 0x10 (16 bytes), I got intermediary value of cp1, let's call this intermediary[1].

Step 2. And then i got rid of cp2 to get IV xor Plaintext[0]. (I just sent IV || cp1) Call cp1 value that satisfied "Wrong Data, but correct padding" when padding = 16(\0x10\0x10....) in step1, as "cp1_."

I sent to server with 0* 32 + cp1_. where I changed 0*32 part in brute forcing, to change padding from 0x01 ~ 0x10, to get IV xor Plaintext[0], now let's call this intermediary[0].

Then I did xor Intermediary[0], and Intermediary[1] with corresponding letter of the quote till the quote length, and the elements left in Intermediary[1], I did xor with the padding necessary.

Step 3. I sent to the server the result of the above computation + "d" * 32.

Appearantly, server is returning "wrong data, but correct padding." And I cannot figure out what I did wrong.

I apologize for the vagueness the question is presenting. thanks in advance.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.