TryHackMe Hacker Holidays Day 5 | Beach Bar Walkthrough | Exploiting Unsafe YAML Deserialization to…

In this walkthrough, we'll solve the Beach Bar room on TryHackMe by exploiting an unsafe YAML deserialization vulnerability, gaining remote code execution, and escalating privileges to root through exposed credentials.

Difficulty: Easy Category: Boot2Root, Web Exploitation, Privilege Escalation

Reconnaissance

As always, I started with an Nmap scan to identify the services running on the target machine.

export IP=<TARGET_IP>
nmap -sC -sV $IP

export IP=<TARGET_IP>
nmap -sC -sV $IP

The scan revealed only two open ports:

• 22/tcp — SSH
• 80/tcp — HTTP (Gunicorn)

The HTTP title redirected to a login page:

Beach Bar // Sign in

Beach Bar // Sign in

Since the attack surface was small, I focused entirely on the web application.

Inspecting the Login Page

Viewing the page source revealed an interesting HTML comment left behind by the developers.

<!--
staff note: the demo DJ login is still enabled for the soft opening.
dj / dj
-->

<!--
staff note: the demo DJ login is still enabled for the soft opening.
dj / dj
-->

This immediately provided valid credentials.

Username

dj

dj

Password

dj

dj

After logging in, the dashboard displayed three options:

• Floor
• Import
• Export

One sentence immediately stood out.

"Export the current playlist as YAML, tweak it, and load it back via Import."

Whenever YAML import functionality appears in Python applications, it's worth checking for unsafe deserialization.

Exporting the Playlist