Skip to main content

CBC-MAC II

CBC-MAC is a message authentication code based on block ciphers (e.g., AES).

Correct usage requirements:

  • Fixed-length messages or
  • Strict domain separation
  • NULL IV (all-zero IV)

CBC-MAC is designed to provide integrity, not confidentiality.

Root Cause​

  • CBC-MAC implementation incorrectly uses a user-controlled IV
  • First block integrity depends on:
IV XOR First_Block
  • Changing the IV allows controlled modification of the first plaintext block without invalidating the MAC

Exploitation Strategy​

  1. Register a username similar in length to target (e.g. bdmin)
  2. Obtain:
    • CBC-MAC signature
    • IV (from cookie)
  3. Compute XOR delta between:
    • Original username block
    • Desired username block (admin)
delta = ord('b') ^ ord('a')
  1. XOR this delta with the IV
import base64

old_iv = base64.b64decode("9sw72AFSCCU=")
delta = ord('b') ^ ord('a')
print(old_iv[0])   # <-- THIS is the first byte

# XOR the first byte of the IV
new_iv = bytearray(old_iv)
new_iv[0] = old_iv[0] ^ delta
# This applies IV' = IV XOR (b XOR a)

new_iv_b64 = base64.b64encode(new_iv).decode()
print(new_iv_b64)
  1. Replace IV in cookie and also change the first byte of main cookie to make it from bdministrator to administrator. hex(ord('a'))
  2. Send modified cookies. Both IV and Main Cookie modified.
  3. Server authenticates attacker as target user