I am currently participating in a CTF Challenge and have reached a stage where I discovered a "log_admin" page. This page generates a cookie that is encrypted using AES 128 ECB. I obtained this information by retrieving the page's source code, which is provided below:


# @TODO: Remove debug stuff for prod
#      : Implement svc and svcparam 
$DEBUG = 0;

$key =  getenv("AES_KEY");

    $svc=(isset($_GET['svc'])) ? $_GET['svc'] : "crawl";
    $svcparam=(isset($_GET['svc_param'])) ? $_GET['svc_param'] : "url";
    if(preg_match("/adm=1/i", $svc) || preg_match("/adm=1/i", $svcparam) ) die('Hacking attempt detected');
    $date = date("Ymd");
    $str_cookie = "service=".$svc.";adm=0;service_param=".$svcparam.";date=".$date;
    $cookie = openssl_encrypt($str_cookie, "AES-128-ECB", $key, OPENSSL_RAW_DATA);
    setcookie('admin', base64_encode($cookie));
    $_COOKIE['admin'] = base64_encode($cookie); 

if(strpos(openssl_decrypt(base64_decode($_COOKIE['admin']),"AES-128-ECB",$key,OPENSSL_RAW_DATA), 'adm=1') !== false){
    $_SESSION['admin'] = true;
    header("Location: admin.php");

    $a = openssl_decrypt(base64_decode($_COOKIE['admin']), "AES-128-ECB", $key, OPENSSL_RAW_DATA);
    print $a;

I understand that the objective is to create a cookie with the value adm=1 in it, and since it is encrypted using AES ECB, I need to exploit the diffusion vulnerability to manipulate the cookie.

However, I have been analyzing the cookie pattern for some time now, and I am unable to identify repetitive blocks that would allow me to manipulate the cookie effectively. If anyone has any suggestions or insights, I would greatly appreciate it.

1 Answer 1


You don't need repetitive patterns. Since the encryption doesn't involve any integrity protection, you can inject your own plaintext using the URL parameter svc, obtain the encrypted cookie and then reassemble or delete blocks of the ciphertext to get the plaintext you want.

Note that svc is checked for adm=1, so you cannot inject this substring directly. However, if you inject adm=[SOME PADDING BYTES]1 and then remove the encrypted [SOME PADDING BYTES] from the ciphertext, you can get adm=1 without running into the check. Hint: If adm= ends at an AES block boundary, and 1 starts at a block boundary, it's easy get get rid of all data in between by deleting the corresponding block(s).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .