how2database

Hack.lu CTF 2026

Task: Spring Boot + jOOQ app with a Postgres system DB, a SELECT-only MariaDB playground and a Redisson-backed Redis executor. Solution: raw jOOQ identifier SQLi to shadow app_user in pg_temp, MariaDB redirect_url to a rogue server for a synthetic extdb row, LDAP-bind Redis command injection, then Redis replication to deliver a Redisson classBody RCE that runs /readflag.