Forge the Cookie

A service encrypts session cookies with AES-128-CBC before handing them to the browser. The plaintext structure never changes: userid=9001;admin=false, PKCS#7-padded out to two 16-byte blocks.

You want admin=false to become admin=true! (same length, so no padding shifts). You don't have the key, and you're not going to break AES — you're going to exploit CBC's block-chaining structure instead.

Give your answer as the exact 5 bytes (as hex, no spaces) you'd need to XOR into the right ciphertext block to make that flip happen — that's the flag: cct{those_5_bytes_as_hex}.