From Insecure Deserialization to Root: TryHackMe “Beach Bar” Walkthrough

Introduction
In this write-up, we will walk through the Beach Bar room on TryHackMe. We will cover how we accessed the web application using default credentials, how directory enumeration revealed hidden web endpoints, how we navigated directly to the import page, how an insecure YAML deserialization vulnerability allowed us to gain a reverse shell, how we located and read the user flag, and how process enumeration exposed cleartext credentials leading to a full root escalation.

Phase 1: Accessing the Web Application & Reconnaissance

1. Logging into the DJ Booth Upon navigating to the target web application, we are greeted with the DJ booth sign-in page. We authenticate using the default credentials for the room:

Username: DJ
Password: DJ

1. Reconnaissance & Nmap Scan We also run an Nmap scan against the target IP to discover open ports and services:

nmap -sV -sC
The scan reveals two main open ports:

Port 22/tcp (SSH): Running OpenSSH 9.6p1.
Port 80/tcp (HTTP): Running a web application powered by Gunicorn.
Press enter or click to view image in full size

Directory Fuzzing with Gobuster
To discover hidden directories and endpoints on the web server, we run gobuster using the medium directory wordlist:

gobuster dir -u http:// -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
As seen in our directory enumeration results:

/login (Status: 200)
/logout (Status: 302)
/export (Status: 302)
/dashboard (Status: 302)
/import (Status: 302)

Navigating to the Import Page
After running Gobuster and discovering the available endpoints, we append /import to the target URL (http:///import) in our browser to access the playlist management and import features.

Phase 2: Exploiting Insecure Deserialization (RCE)
The application features an Import function at this endpoint that processes uploaded playlist YAML files. Reviewing the backend code reveals an insecure deserialization flaw using yaml.load() without a safe loader, which allows Remote Code Execution (RCE).

1. Setting Up a Netcat Listener Open a Netcat listener on your Kali terminal to catch the reverse shell:

nc -lvnp 4444

1. Crafting and Submitting the Payload Instead of file upload scripts, we can target the input form directly. Copy the following payload into the Playlist YAML field on the web interface:

(Make sure to change 10.14.X.X to your Kali tun0 IP address, and 4444 to your open listener port).

1. Triggering the Exploit Click on Load playlist. This executes the payload through the application’s vulnerable YAML parser, granting us an initial foothold as the low-privilege user bartender.

Phase 3: Finding the User Flag
Once we obtain our initial reverse shell connection, we can navigate through the file system to locate the user flag.

Navigate to the home directory of the bartender
cd /home/bartender
List the directory contents to find user.txt:

ls
Read the contents of the flag file:

cat user.txt

User Flag Found: THM{................................}

Phase 4: Privilege Escalation via Process Enumeration
Once inside the system as bartender, we look for running services to find potential privilege escalation vectors. Running ps aux | grep python reveals the active background processes:

ps aux | grep python
As shown in our process inspection:

The jukeboxd.py script runs directly under the root user.
It accidentally passes the stream password in cleartext via command-line arguments: --stream-pass SunsetSpritz2024!.

Phase 5: Gaining Root Access & Finding the Root Flag
Switching to Root: With the exposed cleartext password (SunsetSpritz2024!), we leverage credential reuse to switch user contexts directly to the administrator:
su - root
Enter the password when prompted.
password : SunsetSpritz2024!
Locating and Reading the Root Flag:
Navigate to the root directory and list its contents:
cd /root
ls
Read the contents of root.txt:
cat root.txt

Root Flag Found: THM{..................................}