Bypass CBC-MAC by flipping bits in the IV, which we control.

Original writeup (https://advancedpersistentjest.com/2018/02/11/writeup-cbc-mac-web1-nullcon-im/).