AES

Forging an AES-CBC command block with the server's encryption oracle, encrypting the show command under the previous block as its IV.

Flipping bits in the IV that the server prepends to AES-CBC ciphertext, so the first block decrypts to show instead of test.