Beginner’s Guide to Conquering Bedside on Hack the Box

Key Highlights

• This Hackthebox walkthrough starts with quick scans against the target ip and confirms a web-focused entry point.
• The Bedside path centers on a Linux machine running an HTTP service on port 80.
• Enumeration reveals a hidden dev directory that exposes a PHP shell and enables initial access.
• From there, you can grab the user flag with simple filesystem checks.
• Privilege escalation relies on weak sudo rights and a writable Python script.
• To Access the Complete non-public writeup, Please CLICK HERE
• To Access the Complete non-public scripts-only, Please CLICK HERE
• To Access the Complete non-public writeup explanation, Please CLICK HERE

Introduction

If you want a beginner-friendly Hackthebox challenge that teaches solid cybersecurity habits, Bedside is a good fit. This Linux target rewards careful checking rather than flashy exploitation. You start with simple web enumeration, notice exposed files, and turn that into shell access. After that, the path becomes a lesson in permissions, sudo behavior, and how a small password-free action can grow into full control. It is a practical machine for learning how real Linux mistakes can lead to compromise.

Bedside HTB Writeup Overview

BedSide is a Medium-difficulty Linux machine from Hack The Box that focuses on modern web application security, insecure deserialization, and privilege escalation through unsafe machine learning workflows. This BedSide Hack The Box Walkthrough demonstrates how seemingly harmless file processing features can become critical attack vectors when applications deserialize untrusted data. Although the machine initially exposes only SSH and HTTP services, careful reconnaissance reveals additional functionality that ultimately leads to full system compromise.

The attack begins with web enumeration and virtual host discovery, eventually uncovering a research application that processes uploaded PDF documents. As covered in this BedSide Hack The Box Writeup, the application is vulnerable to CVE-2025-64512, an insecure deserialization vulnerability in pdfminer.six. By abusing this flaw, it is possible to achieve remote code execution and gain an initial foothold on the target. This stage of the bedside htb walkthrough highlights the importance of understanding backend document-processing pipelines and the security risks associated with Python’s pickle serialization mechanism.

Once initial access is obtained, the machine shifts toward post-exploitation and internal reconnaissance. The bedside htb write up explores how enumerating Docker environments and internal-only services reveals a development application that is inaccessible from outside the host. A path traversal vulnerability within this service allows sensitive files, including SSH credentials, to be accessed, enabling a pivot to a more privileged user account. This section reinforces the importance of thoroughly investigating internal services and containerized environments during penetration testing engagements.

Privilege escalation introduces another real-world vulnerability involving machine learning infrastructure. The final phase of this HackTheBox – BedSide HTB Season 11 machine complete walkthrough demonstrates how a root-executable training script unsafely loads attacker-controlled PyTorch checkpoint files using torch.load(). Since PyTorch checkpoints internally rely on Python’s pickle format, loading an untrusted model can result in arbitrary code execution with root privileges. This serves as an excellent example of why machine learning artifacts should always be treated as executable content rather than passive data.

Overall, BedSide – HackTheBox provides an engaging and educational challenge that combines web exploitation, Docker enumeration, internal service discovery, credential pivoting, and Python deserialization vulnerabilities into a realistic attack chain. Whether you’re searching for a bedside.htb walkthrough, want to understand how to obtain the bedside htb machine user flag, or are looking for guidance on capturing the bedside Hack The Box machine root flag, this guide explains every stage of the compromise while also discussing the underlying vulnerabilities, exploitation methodology, and defensive best practices. If you’ve just solved BedSide from Hack The Box or are preparing to tackle the machine yourself, this walkthrough aims to provide both practical insights and a deeper understanding of the security concepts demonstrated throughout the challenge.

To Access the Complete non-public writeup, Please CLICK HERE

To Access the Complete non-public scrpits-only, Please CLICK HERE

To Access the Complete non-public writeup explanation, Please CLICK HERE

NEXT: Mastering DarkZeroReturns: Beginner’s Guide from Hack The Box

I just solved BedSide from Hack the Box!

Initial Foothold

Enumeration

A full TCP scan reveals only two externally accessible services.

The small attack surface immediately suggests that most of the attack chain will occur through the web application.

Web Enumeration

Browsing the main website presents a document upload portal.

The functionality appears fairly minimal:

• Upload PDFs
• Process documents
• Display uploaded files

At first glance nothing particularly interesting appears exposed.

Directory enumeration uncovers another virtual host.

research.bedside.htb

After updating the local hosts file, the new application becomes accessible.

File Upload Functionality

The research portal accepts uploaded documents and stores them beneath an uploads directory.

Example:

http://research.bedside.htb/uploads/

Uploaded images become directly accessible through predictable URLs.

This strongly suggests that uploaded content is processed by a backend worker.

Further analysis indicates that uploaded PDFs are parsed using pdfminer.six.

Rather than simply extracting text, the application loads embedded font resources during parsing.

This behavior becomes extremely important.

CVE-2025-64512 – pdfminer.six Unsafe Deserialization

The application is vulnerable to:

CVE-2025-64512

The vulnerability affects pdfminer.six when parsing malicious PDFs referencing compressed pickle files as CMap resources.

Internally, pdfminer eventually reaches Python’s:

pickle.load()

Any Python object implementing:

__reduce__()

can execute arbitrary code during deserialization.

This turns a seemingly harmless PDF into a Remote Code Execution primitive.

Initial Access

A specially crafted PDF referencing a malicious compressed pickle is uploaded.

When the backend worker processes the PDF:

1. pdfminer loads the embedded CMap.
2. The compressed pickle is decompressed.
3. Python deserializes the object.
4. Arbitrary code executes as the PDF processing user.

This provides initial shell access.

Local Enumeration

Once inside the host, standard Linux enumeration reveals:

• Docker environment
• Mounted volumes
• Internal networking
• Application source code

Attack Chain Summary

External Enumeration
        │
        ▼
research.bedside.htb
        │
        ▼
    PDF Upload
        │
        ▼
    pdfminer.six
        │
        ▼
       RCE
        │
        ▼
Docker Enumeration
        │
        ▼
Internal Dev Server
        │
        ▼
Path Traversal
        │
        ▼
Read Developer SSH Key
        │
        ▼
    SSH Login
        │
        ▼
sudo Training Script
        │
        ▼
Unsafe torch.load()
        │
        ▼
      Root

Machine Specifications and Initial Access

The first scan of the target ip shows a very limited attack surface. A full TCP sweep returns just one open port, 80, which immediately shifts attention to the web layer. That is useful because a narrow surface often means your entry point is easier to prioritize.

A more detailed scan identifies Apache 2.4.18 on Ubuntu and suggests the host is a Linux machine with a Linux kernel in the 3.x to 4.x range. OS detection is not perfect because there is only one open port, but the result is still a strong clue. If you are wondering what operating system runs on Bedside HTB, the evidence points to Ubuntu Linux.

Initial access comes through a PHP shell found in a web directory. After loading it in the browser, simple commands confirm command execution. Using whoami shows www-data, and running id helps confirm the low-privilege context. At this stage, you do not have root privileges, so local enumeration becomes the next priority.

Important Details About the Bedside Hack The Box Challenge

One important detail about Bedside Hack The Box is that the whole compromise begins with the HTTP service. There are no extra ports to distract you, so the initial steps to enumerate the Bedside Hack The Box box are focused and practical. You scan, fingerprint the web server, and then look for hidden content.

During browsing and directory checks, the standout finding is an exposed dev folder with directory listing enabled. Inside it sit two PHP files that strongly suggest a web shell. That is the kind of clue you should never ignore on a Linux target, especially when the browser confirms direct command execution.

After access is gained, checking local files becomes essential. Reviewing /etc/passwd reveals interesting usernames such as arrexel and scriptmanager. No password is needed at that point because the shell already provides execution as www-data. The challenge then shifts from external discovery to internal privilege paths, where usernames, permissions, and command rights matter more than brute force.

Reconnaissance and Enumeration Strategies

Bedside is a reminder that good enumeration wins boxes. Nmap quickly reduces the noise by showing a single useful service, and that makes your next move obvious. Instead of scattering effort, you focus on the web server and start mapping what it exposes.

From there, directory discovery and manual review do the heavy lifting. Automated checks identify interesting paths, while direct inspection confirms what matters. That mix of nmap, directory brute forcing, and careful browser testing is what helps solve the Bedside HTB box. The next two sections break down those techniques.

Effective Nmap Scans and Service Detection

Start with Nmap because it gives structure to everything that follows. A full scan against the target ip shows only port 80 open, which is a strong sign that the box is web-driven. That alone narrows your attention and saves time.

Next, use deeper service detection on port 80. The result identifies Apache 2.4.18 on Ubuntu, shows the site title, and provides a rough Linux kernel guess. Even when OS fingerprinting is not fully reliable, this level of detail is enough to shape your plan and confirm you are dealing with a Linux host.

Useful scan takeaways include:

• Nmap reveals 80/tcp as the only open service on the target ip.
• Service detection identifies Apache httpd 2.4.18 on Ubuntu.
• The page title gives a clue that the site is related to development activity.
• OS guesses point to a Linux kernel range, supporting later privilege escalation ideas.

Manual Web and Directory Exploration Techniques

After automated scanning, switch to manual checks. A directory scan surfaces common web folders, but one result matters far more than the rest: /dev. On a target with only one HTTP entry point, a strange directory often deserves your full attention.

Opening /dev in the browser does not immediately reveal everything, so a direct request confirms directory listing is enabled. That exposes phpbash files, which strongly suggests remote command execution. Loading the larger PHP shell in the browser gives an interactive terminal-like view and turns web enumeration into a foothold.

Good manual steps on this box are:

• Visit the website in a browser and review visible content first.
• Run directory discovery to identify hidden paths under the HTTP service.
• Inspect /dev manually when automated tools do not show enough detail.
• Once inside the shell, use basic commands before touching anything like Python files or scripts.

ALSO READ: Mastering MakeSense: Beginner’s Guide from Hack The Box

Identifying Vulnerabilities and Attack Vectors

The main vulnerabilities on Bedside are not exotic. They come from exposed web content, unsafe permissions, and trust between local users. That makes this machine useful for learning because the attack vectors mirror common operational mistakes rather than rare bugs.

At first, the visible issue is a web shell left in a reachable directory. Later, the real privilege escalation path comes from sudo rights and a writable script that appears to run as root. Even though the Linux kernel version is noted during scanning, the winning path is configuration abuse, not kernel exploitation.

Common Weaknesses Found on Bedside HTB

One weakness appears before login even exists: exposed development content. A PHP shell in a public directory is enough to hand over command execution to anyone who finds it. That kind of oversight is the first major vulnerability on Bedside HTB and the reason the box falls so quickly.

The second issue is weak privilege separation. From the www-data context, local enumeration reveals users and accessible locations. One home directory contains the user flag, which shows how damaging a small foothold can become when internal permissions are not tight enough.

The most important weaknesses are:

• Publicly accessible development files under a dev directory.
• A working PHP shell that allows direct command execution.
• Password-free sudo access from www-data to another user.
• A writable Python script tied to execution that leads to the root flag.

Recognizing Misconfigurations and Exploitable Services

Misconfigurations are the real story here. Nmap points you to the web service, but the actual break comes from how that service and the local system are configured. Directory listing is enabled, a shell is exposed, and sudo permissions let a web user act as scriptmanager without a password. Those are exploitable services because they reduce the need for any advanced exploit.

Local testing confirms the final misconfiguration. A script in /scripts is writable by scriptmanager, and behavior suggests it is executed automatically by root. When test.txt is moved away and then reappears owned by root, that is the signal that root privileges are being used somewhere in the background.

This combination answers a common question about effective tools. Nmap, a directory scanner, curl, and basic shell commands are enough because the misconfigurations do most of the work for you.

Conclusion

In conclusion, conquering the Bedside machine on Hack The Box is an enriching journey that enhances your cybersecurity skills. By mastering reconnaissance techniques and understanding how to identify vulnerabilities, you’ll not only improve your hacking abilities but also gain confidence in tackling similar challenges in the future. As you continue to practice and refine your skills, remember that the community around Hack The Box is a valuable resource for sharing insights and strategies. Don’t miss out on the opportunity to stay updated with the latest tips and tricks—subscribe for more content that will help you excel in your hacking endeavors!

Frequently Asked Questions

What operating system does the Bedside HTB machine run?

Based on service detection, Bedside appears to be a Linux machine running Ubuntu with a Linux kernel in the 3.x to 4.x range. The scan is done against the target ip, and while that detail does not directly reveal the root flag, it helps shape your Hackthebox approach.

Are custom scripts or exploits necessary for Bedside Hack The Box?

No, custom scripts are not necessary here. Standard tools and manual checks are enough. The exposed dev directory, built-in shell access, and a writable Python file provide the path. The privilege escalation relies more on spotting bad permissions than on writing a fresh exploit for Hackthebox.

Do you need hints to capture the user or root flag on Bedside HTB?

Most players can get the user flag without many hints if they inspect the web content carefully. The root flag may need a bit more patience because the final path depends on noticing script behavior. Still, this is a fair Hackthebox cybersecurity challenge with clues that are visible through steady enumeration.