$ grep -l "#remote-code-execution" ~/blog/*
#remote-code-execution
1 post · all posts
LFI + Unsafe YAML Deserialization leads to RCE
A TryHackMe Industrial Intrusion CTF 2025 write-up: chaining a blacklist-bypass LFI with an unsafe PyYAML loader to read source code and get remote code execution.