Bashed

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Bashed (Ubuntu, attack surface: Apache httpd 2.4.18 ((Ubuntu)) (80)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.68 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80).
• Scan used: nmap -p- -sVC 10.10.10.68 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.68 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-25 02:31 PDT
Stats: 0:00:13 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 0.00% done
Nmap scan report for 10.10.10.68
Host is up (0.019s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Arrexel's Development Site

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.82 seconds

1. Based from the result, the machine is running a web application.

2. Found an interesting directory --> /dev which leads to a file named phpbash.php.

3. Why it's interesting, because the webpage documented about it, and based from the documentation it gives us a shell.

GITHUB DOCUMENTATION

1. So, opening the phpbash.php file will give us a shell.

www-data@bashed
:/home# cd arrexel

www-data@bashed
:/home/arrexel# ls

user.txt
www-data@bashed
:/home/arrexel# cat user.txt

REDACTED

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

FLOW

1. Creating a fake test.py which has our reverse shell payload.
2. Run python http.server.
3. Then run wget on our reverse shell to grab the fake test.py from our local machine.

Root flag: REDACTED

Flags

Lessons Learned

1. Directory listing using gobuster.
2. Webshell upload.
3. Switch user at webshell --> sudo -u <username> bash -i.
4. Utilizing cronjob to gain root.