# Bedside Writeup - HackTheBox

> Memory forensics challenge using Volatility to analyze a Linux memory dump, extracting artifacts to uncover hidden flags through process and file analysis.

- **URL:** https://hackindex.io/writeups/bedside
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Linux
- **Tags:** lfi, file-upload, deserialization, privilege-escalation, suid, sudo-misconfiguration, docker-escape, cve-2025-64512
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 6 min read
- **Published:** 2026-06-15
- **Updated:** 2026-07-23

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

Domain: **bedside.htb**

## **Reconnaissance**

Full TCP port sweep first:

```bash
nmap -p- -T4 --min-rate 1000 --open $TARGET_IP -oA scans/bedside-tcp-full
# 22/tcp open  ssh
# 80/tcp open  http
```

Version and script scan on the two open ports:

```bash
nmap -sC -sV -p 22,80 $TARGET_IP -oA scans/bedside-tcp-services
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 10.0p2 Debian 7+deb13u4 (protocol 2.0)
# 80/tcp open  http    Apache httpd 2.4.68
# |_http-server-header: Apache/2.4.68 (Debian)
# |_http-title: Bedside Clinic - bedside.htb
```

Only a static clinic site on port 80. Nothing to exploit directly, so pivot to vhost enumeration:

```bash
ffuf -u http://bedside.htb/ -H "Host: FUZZ.bedside.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -fs <size_of_default_response>
# research.bedside.htb  [Status: 200]
#
```

Add it to `/etc/hosts` and browse it. `research.bedside.htb` is "Bedside Research Portal", a file upload form. This is the real attack surface.

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.