Can a penetration test write-up be used as a bachelor thesis?
Sorry, but the only valid answer will come from the professor. It is acceptable or not based on their views only. 

But be aware that a penetration test on a real system can come with legal implications. Claiming to be a white hat may hold little weight with authorities. Gaining permission, as you suggest, might be very difficult as institutions running real system have a lot of concerns beyond the obvious. Their own legal department might nix any such project. 

A simulated system is fine, though seldom has sufficient protections in place for a valid test. An iterative, competitive, duel between two teams (Red team, Blue team) might be interesting. 

The answer to the general question, though, is yes, such a test can be used as a thesis, but only with the consent of the advisor. The general answer to the question has exactly zero impact on your case.