Skip to content
HackIndex logo

HackIndex

Bedside Writeup - HackTheBox

Medium Linux
Discuss on Discord

Last updated July 18, 2026 • 6 min read

Joshua

HackIndex Creator

Would you like to solve this machine together? Join our discord and/or our open HTB team!

Domain: bedside.htb

Join the HackIndex community

Share writeups, ask questions, and stay current with techniques. Over 400 members.

Join Discord (opens in new tab)

Medium-difficulty Linux box built around a single vulnerability class: insecure pickle deserialization, chained twice. First hit gets code execution inside a processing container. Second hit, on a completely different service, gets root on the real host.

Reconnaissance

Full TCP port sweep first:

┌──(kali㉿kali)-[~]
└─$ nmap -p- -T4 --min-rate 1000 --open $TARGET_IP -oA scans/bedside-tcp-full 
22/tcp open  ssh
80/tcp open  http

Version and script scan on the two open ports:

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p 22,80 $TARGET_IP -oA scans/bedside-tcp-services 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 7+deb13u4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.68
|_http-server-header: Apache/2.4.68 (Debian)
|_http-title: Bedside Clinic - bedside.htb

Only a static clinic site on port 80. Nothing to exploit directly, so pivot to vhost enumeration:

┌──(kali㉿kali)-[~]
└─$ ffuf -u http://bedside.htb/ -H "Host: FUZZ.bedside.htb" \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
-fs <size_of_default_response> 
research.bedside.htb  [Status: 200]

Add it to /etc/hosts and browse it. research.bedside.htb is "Bedside Research Portal", a file upload form. This is the real attack surface.

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.