Beach Bar — TryHackMe Hacker Holidays 2026 Day 5 Writeup

Day 5 boot2root walkthrough: demo creds in view-source, an unsafe yaml.load turns a playlist import into RCE, ps aux leaks the root password. Flags redacted.