Pickle Rick — TryHackMe Write-up
A Rick and Morty CTF. Help turn Rick back into a human!
This Rick and Morty themed challenge requires you to exploit a webserver to find 3 ingredients that will help Rick make his potion to transform himself back into a human from a pickle.
As always, the first thing we need to do is to run scan for open ports
As we can see, there are three open ports on the machine; 22, 80, and 2301. However, let’s focus on port 80 as that would more likely to give us something to work with.
Here’s the webpage:
It’s a plain static webpage so not much information right there. Let’s check if we can find something interesting on the page source.
A username! That’s not very smart Rick!
Another common hidden file on webpages like this is the robots text file.
So now we have a username, R1ckRul3s, and a random string from robots.txt, Wubbalubbadubdub.
The question is where can we use these? Time to run Dirbuster!
There are lots of accessible files and directory but that login.php looks the most interesting.
We all know the username. Maybe that weird string on robots.txt is the password?
It worked! Now we’re successfully logged in. However, it seems like some commands are not allowed such as cat.
Let’s attempt to run a reverse shell on the command panel.
You can choose from these list of reverse shells. Once it’s working, you should now have access to the machine.
It’s good to always check our current username and we can do that using the whoami command.
We could also check what commands we can run as this user using sudo -l
So that means we can run any command without restrictions!
Getting the ingredients
First Ingredient
On the initial directory after getting a shell, we’ll see an interesting file. Opening it will get us the first ingredient.
Second Ingredient
So where’s the other ingredients? Let’s see the content of clue.txt.
Look around the file system for the other ingredient
We could manually look around the entire file system for the other ingredients or we could just utilize the find command.
cat to see the second ingredient!
Third Ingredient
Going to the / directory, we can see a “root” directory. However, navigating to or accessing it is not allowed.
We need to use sudo to see the content of the directory, and hopefully the flag.
That’s it! Congratulations on completing this room!
