J
J
jajabin2020-03-18 02:46:07
go
jajabin, 2020-03-18 02:46:07

How to implement Bit-Flipping attack on AES-CBC?

I am doing a task with root-me.org , as I understand from the attack formulation, it is necessary to perform a byte shift to get is_member=true After reading some instructions, I supplement the message with a block and accordingly do xor with the previous one, but when the token is handed over, the next decryption output

b'[id=546815648;name=iziziz;is_member=false;mail=blablacar;pad=00]r\xe5\xf2\x1dM\xa5\xcae\xff\x16\xa2\xc6\xbe\xd8~I'

Tell me what I could be missing, my code:
var TOKEN = 
"IRZjBh6GxjeYI7YZvxwfBHmxjY+Wd7bPr7s73wWwLHKaR+N8fPDIjT8/AlUIDSzniMgqCV9bJArQbec64kPYXQ=="

// [id=546815648;name=iziziz;is_member=false;mail=blablacar;pad=00]
func main() {
    //block 16
    tokenHex, err := base64.StdEncoding.DecodeString(TOKEN) // lenght 64
    if err != nil {
        log.Fatal(err)
    }
    block := 16
    for i := 0; i < len(tokenHex); i += block {
        fmt.Println(tokenHex[i : i+block])
    }

    tmp := make([]byte, block)
    for i := 0; i < block; i++ {
        tmp[i] = byte('a')
    }
    tokenHex = append(tokenHex,tmp...)
    expected := []byte(`;is_member=true]`)
    //last block
    current := []byte{136 ,200 ,42 ,9 ,95 ,91, 36, 10 ,208 ,109, 231, 58, 226, 67 ,216, 93}
    for i := 0; i < 16; i++ {
        xor := expected[i] ^ current[i]
        tokenHex[64+i] ^= xor
    }
    fmt.Println(base64.StdEncoding.EncodeToString(tokenHex))
}

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question