# Jean-Sébastien Bash
We get a shell which only accepts encrypted commands, and the `/help`function tells us the format is:
```/cmd AES(key, CBC, iv).encrypt(my_command)```
We also get a sample command, and if we try running it we will getsome fairly helpful output:
```Running b'ls -l'total 8-rw-r--r-- 1 root root   21 Apr 25 21:18 flag.txt-rwxr-xr-x 1 root root 2066 Apr 25 21:50 server.py```
If we try running `/cmd <random string>`, we will just get a "What doyou mean?!" error. We can assume that we get the error due toincorrect padding, and can try an attack that looks a bit like apadding oracle (but doesn't quite go through the entire process). Wewill take an arbitrary 32-byte string, and try all possible values forthe sixteenth byte until we hit a string with valid padding (since thelast byte of the decrypted data is xored with the last byte of thefirst block). 
Once we find it, the server will tell us what it decrypts to and tryto execute (and get a bunch of errors, since it is gibberish). We cannow change the start of the first block to get a command in the secondblock. Since we cannot control what comes before the command, we willsimply add a semicolon before and after:
```# the string with correct padding we foundget = b'\x15\x02\x9c;\x95\xe6\xcc\xe3\x10B\x97\x90\x9d7EYU\xad0A\xf8\xd6\x1f\xea\xaf\xd6\xf7\xa0>\x84D'
want = '; cat flag.txt;' 
for i, w in enumerate(want):    base[i] = base[i] ^ ord(w) ^ get[i+16]
print('/cmd', binascii.hexlify(bytes(base)).decode('ascii'))```
Submitting this to the server runs `<random data>; cat flag.txt;<random>`, which throws several errors, but also prints the flag.