$ grep -l "#thm" ~/blog/*
#thm
1 post · all posts
LFI + Unsafe YAML Deserialization leads to RCE
A TryHackMe Industrial Intrusion CTF 2025 write-up: chaining a blacklist-bypass LFI with an unsafe PyYAML loader to read source code and get remote code execution.