CBC-MAC II
This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV
This course details the exploitation of a vulnerability in website authentication that uses CBC-MAC to ensure username integrity. The website signs the username and sends it as a cookie, alongside an IV that is also sent back to users. The danger arises when the IV is controlled by the attacker, which breaks the integrity of the CBC-MAC signature. By modifying the IV, attackers can change the first block of the cleartext without altering the signature, allowing them to forge credentials and gain unauthorized access.
Proper CBC-MAC implementation should use a NULL Initialisation Vector to prevent this type of attack. In this exercise, you will learn how to manipulate the IV to become an administrator. You will first log in with a username similar to "administrator" and then tamper with the IV to change your username to "administrator," maintaining a valid signature. This exercise demonstrates the critical importance of securing IVs in CBC-MAC implementations to maintain the integrity of the signature.