TryHackMe: “Beach Bar” Room Walkthrough ( Hacker’s Holiday Challenge )

Link : http://tryhackme.com/room/hh-beachbar-d849f7f7 Difficulty : Easy

Step 1: Reading the source code

We can cleary see the staff note and the demo login credentials present in the code. After trying the demo credentials which are dj for both pass and username we logged in successfully.

Here after searching for sometime we dont find anything usefull other than the import feature which allows us to import an yaml file.

There are many yaml decoders present which might be vulnerable to Insecure Deserialization (Object Injection) attack. So i tested one attack for Python's PyYAML library.

Which in return gave us exit code 0 which means success in linux. So it was confirmed that our commands are been run in the backend. So i started an listener on port 4444 on my host OS.

nc -lvnp 4444

nc -lvnp 4444

Then pasted this below reverse shell script in the vulnerable input.

After you click the load playlist you get a reverse shell on your host machine which you can now use to communicate with the backend.

Now to make your connection stable you can type in this command:

python3 -c 'import pty; pty.spawn("/bin/bash")'

python3 -c 'import pty; pty.spawn("/bin/bash")'

After that now we can search the files for the flag.

grep -rn "THM{" /home /root /opt /var/www 2>/dev/null

grep -rn "THM{" /home /root /opt /var/www 2>/dev/null

This way we got the first user flag.

User Flag: THM{y4ml_pl4yl1st_pwns_th3_b34ch}

After checking the files in the terminal i came accross the jukeboxd folder. On opening the jukeboxd.py file i found out — stream-pass

Now there must be a jukeboxd.service running lets check that.

systemctl show jukeboxd.service | grep ExecStart

systemctl show jukeboxd.service | grep ExecStart

From the above image we can see the value for the stream-pass which is :

SunsetSpritz2024!

SunsetSpritz2024!

Now we login as root:

su root

su root

Put the password found above SunsetSpritz2024! and then find the flag:

grep -rn "THM{" /home /root /opt /var/www 2>/dev/null

grep -rn "THM{" /home /root /opt /var/www 2>/dev/null

Root flag : THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}