Paper Plane

cryptohack

Task: a CryptoHack AES-IGE (Telegram MTProto mode) service exposes a PKCS7 padding oracle via send_msg(ct, m0, c0). Solution: with attacker-controlled per-block IGE parameters, decryption of a single block P = D(C XOR m0) XOR c0 is exactly a CBC relation, so a standard CBC padding-oracle (256 guesses/byte) on c0 recovers each intermediate, then the IGE chaining feeds recovered plaintext as the next m0 to peel off the flag blocks.