Hack The Box - HTB BedSide Writeup - Medium - Weekly - July 19th, 2026

Add the vhosts to your hosts file before starting:

echo "<TARGET> bedside.htb research.bedside.htb" | sudo tee -a /etc/hosts
# HTB VPN frequently black-holes large outbound requests; lower the tunnel MTU to be safe
sudo ip link set dev tun0 mtu 1300

1. Recon

nmap -Pn -sT -p- --min-rate 1500 --max-retries 3 <TARGET>
nmap -Pn -sCV -p22,80,3000 <TARGET>

22/tcp   open     ssh      OpenSSH 10.0p2 Debian 7+deb13u4  (Debian 13 "trixie")
80/tcp   open     http     Apache/2.4.68 (Debian)  → redirects to http://bedside.htb
3000/tcp filtered

Port 80 redirects to bedside.htb, a static "clinic" site. Fuzz for vhosts:

ffuf -u http://bedside.htb/ -H "Host: FUZZ.bedside.htb" \
     -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
     -fs <default-response-size>
# → research

research.bedside.htb is a medical file-upload portal. It accepts
jpeg, jpg, png, bmp, tiff, dcm, pdf and archives (gz, zip), and says files "may be converted
to standardized formats before being used for AI training." The response header names the backend:

curl -sI http://research.bedside.htb/ | grep -i x-powered-by
# X-Powered-By: pdfminer.six

Uploaded files are stored and web-served at /uploads/<name>. A deliberately malformed upload
leaks the absolute destination path:

MIME type mismatch. Unable to upload file to destination /var/www/research.bedside.htb/uploads

2. Foothold