Parent said "decrypt", not "get the decryption key", and parent is correct. The attack looks kind of similar to a "padding oracle attack", where you work one byte at a time using a block boundary.