Change plain text in AES CBC using change IV

AES slipt attack

from flask import Flask, render_template, request, url_for, redirect, make_response, flash
import json
from hashlib import md5
from base64 import b64decode
from base64 import b64encode
from Crypto import Random
from Crypto.Cipher import AES

app = Flask(__name__)
app.secret_key = 'seed removed'
flag_value = 'flag removed'

16 = 16	# Bytes
pad = lambda s: s + (16 - len(s) % 16) * \
								chr(16 - len(s) % 16)
unpad = lambda s: s[:-ord(s[len(s) - 1:])]


@app.route("/")
def main():
		return render_template('index.html')

@app.route('/login', methods=['GET', 'POST'])
def login():
		if request.form['user'] == 'admin':
				message = "I'm sorry the admin password is super secure. You're not getting in that way."
				category = 'danger'
				flash(message, category)
				return render_template('index.html')
		resp = make_response(redirect("/flag"))

		cookie = {}
		cookie['password'] = request.form['password']
		cookie['username'] = request.form['user']
		cookie['admin'] = 0
		print(cookie)
		cookie_data = json.dumps(cookie, sort_keys=True)
		encrypted = AESCipher(app.secret_key).encrypt(cookie_data)
		print(encrypted)
		resp.set_cookie('cookie', encrypted)
		return resp

@app.route('/logout')
def logout():
		resp = make_response(redirect("/"))
		resp.set_cookie('cookie', '', expires=0)
		return resp

@app.route('/flag', methods=['GET'])
def flag():
	try:
			encrypted = request.cookies['cookie']
	except KeyError:
			flash("Error: Please log-in again.")
			return redirect(url_for('main'))
	data = AESCipher(app.secret_key).decrypt(encrypted)
	data = json.loads(data)

	try:
		 check = data['admin']
	except KeyError:
		 check = 0
	if check == 1:
			return render_template('flag.html', value=flag_value)
	flash("Success: You logged in! Not sure you'll be able to see the flag though.", "success")
	return render_template('not-flag.html', cookie=data)

class AESCipher:
		"""
		Usage:
				c = AESCipher('password').encrypt('message')
				m = AESCipher('password').decrypt(c)
		Tested under Python 3 and PyCrypto 2.6.1.
		"""

		def __init__(self, key):
				self.key = md5(key.encode('utf8')).hexdigest()

		def encrypt(self, raw):
				raw = pad(raw)
				iv = Random.new().read(AES.16)
				cipher = AES.new(self.key, AES.MODE_CBC, iv)
				return b64encode(iv + cipher.encrypt(raw))

		def decrypt(self, enc):
				enc = b64decode(enc)
				iv = enc[:16]
				cipher = AES.new(self.key, AES.MODE_CBC, iv)
				return unpad(cipher.decrypt(enc[16:])).decode('utf8')

if __name__ == "__main__": pass
		app.run()


# Solved
raw = "{'admin': 0, 'password': 'kev@123', 'username': 'kev'}"
cookie = 'KEXA2zZoj+n1is/55lDJNEJ6Rm+BZ8X2787Hbrp59/04YKr/NNbESEi9s+Mwmvk1IoI71a5tRmfn5oFZASEWTAtZPR0a3R/UekbMZ9Brezg='
iv = b64decode(cookie)
iv = list(iv)
# Change iv[10] from '0' to '1'
iv[10] = iv[10] ^ 0x01 
print(b64encode(bytes(iv)))

# print( b64encode( iv ) )