CTR Mode and Chosen Plaintext Attacks
Suppose you know a way to distinguish a message encryption scheme of the form $$\operatorname{CTR}[E_k](n, m) = (E_k(f(n, 0)) \oplus m_0) \mathbin\Vert (E_k(f(n, 1)) \oplus m_1) \mathbin\Vert \cdots$$ for unknown $k$ from a uniform random string with probability better than you would get for CTR mode $\operatorname{CTR}[\pi](n, m)$ of a uniform random permutation.

Here $f$ is a standard injection from nonce/counter pairs to cipher blocks (say, $(n, i) \mapsto n \mathbin\Vert i$ on 96-bit nonces and 32-bit counters), $n$ is a nonce, and $m$ is a message $m_0 \mathbin\Vert m_1 \mathbin\Vert \cdots$.  Note that there is always a generic birthday attack on CTR mode, so the premise is that you have a distinguisher with higher success probability than the generic birthday attack for the same number of queries to the oracle.

How could you use this to distinguish $E_k$ for uniform random $k$ from a uniform random permutation $\pi$?  You are allowed to feed in $f(n, 0)$ and throw $m_0$ into the mix if you know some $n$ and $m_0$ that lets you break $\operatorname{CTR}[E_k]$, for example—it is a chosen plaintext attack.