Post cover image

July 31, 2026

From Insecure Deserialization to Root: TryHackMe “Beach Bar” Walkthrough

Introduction

By mohammad ali barham

3 min read

Introduction

In this write-up, we will walk through the Beach Bar room on TryHackMe. We will cover how we accessed the web application using default credentials, how directory enumeration revealed hidden web endpoints, how we navigated directly to the import page, how an insecure YAML deserialization vulnerability allowed us to gain a reverse shell, how we located and read the user flag, and how process enumeration exposed cleartext credentials leading to a full root escalation.

Phase 1: Accessing the Web Application & Reconnaissance

1. Logging into the DJ Booth

Upon navigating to the target web application, we are greeted with the DJ booth sign-in page. We authenticate using the default credentials for the room:

  • Username: DJ
  • Password: DJ
None None

2. Reconnaissance & Nmap Scan

We also run an Nmap scan against the target IP to discover open ports and services:

nmap -sV -sC <TARGET_IP>

The scan reveals two main open ports:

  • Port 22/tcp (SSH): Running OpenSSH 9.6p1.
  • Port 80/tcp (HTTP): Running a web application powered by Gunicorn.
None

Directory Fuzzing with Gobuster

To discover hidden directories and endpoints on the web server, we run gobuster using the medium directory wordlist:

gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

As seen in our directory enumeration results:

  • /login (Status: 200)
  • /logout (Status: 302)
  • /export (Status: 302)
  • /dashboard (Status: 302)
  • /import (Status: 302)
None

Navigating to the Import Page

After running Gobuster and discovering the available endpoints, we append /import to the target URL (http://<TARGET_IP>/import) in our browser to access the playlist management and import features.

Phase 2: Exploiting Insecure Deserialization (RCE)

The application features an Import function at this endpoint that processes uploaded playlist YAML files. Reviewing the backend code reveals an insecure deserialization flaw using yaml.load() without a safe loader, which allows Remote Code Execution (RCE).

None

1. Setting Up a Netcat Listener

Open a Netcat listener on your Kali terminal to catch the reverse shell:

nc -lvnp 4444
None

2. Crafting and Submitting the Payload

Instead of file upload scripts, we can target the input form directly. Copy the following payload into the Playlist YAML field on the web interface:

None None

(Make sure to change 10.14.X.X to your Kali tun0 IP address, and 4444 to your open listener port).

3. Triggering the Exploit

Click on Load playlist. This executes the payload through the application's vulnerable YAML parser, granting us an initial foothold as the low-privilege user bartender.

None

Phase 3: Finding the User Flag

Once we obtain our initial reverse shell connection, we can navigate through the file system to locate the user flag.

None
  1. Navigate to the home directory of the bartender
cd /home/bartender

List the directory contents to find user.txt:

ls

Read the contents of the flag file:

cat user.txt
None

User Flag Found: THM{y4ml_pl4y11st_pwns_th3_b34ch}

Phase 4: Privilege Escalation via Process Enumeration

Once inside the system as bartender, we look for running services to find potential privilege escalation vectors. Running ps aux | grep python reveals the active background processes:

ps aux | grep python

As shown in our process inspection:

  • The jukeboxd.py script runs directly under the root user.
  • It accidentally passes the stream password in cleartext via command-line arguments: --stream-pass SunsetSpritz2024!.
None

Phase 5: Gaining Root Access & Finding the Root Flag

  1. Switching to Root: With the exposed cleartext password (SunsetSpritz2024!), we leverage credential reuse to switch user contexts directly to the administrator:
su - root
  • Enter the password when prompted.
password : SunsetSpritz2024!
  • Locating and Reading the Root Flag:
  • Navigate to the root directory and list its contents:
cd /root
ls
  • Read the contents of root.txt:
cat root.txt
None
  • Root Flag Found: THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}