Pickle Rick

Tools Used:

Environment:

After deploying the machine, I ran an Nmap scan:

Two open ports were found:

Step One — Discovering Credentials

Visiting the web application in a browser showed a landing page with a message from Rick. Inspecting the HTML source revealed a username hidden in a comment:

Username: R1ckRul3s

I then checked robots.txt directly:

The file contained a single string — Rick's famous catchphrase — which turned out to be the portal password:

Password: Wubbalubbadubdub

An attempt to log in via SSH with these credentials failed, so I moved on to further enumeration.

Step Two — Directory Enumeration

I ran Gobuster with PHP and text file extension enumeration to find hidden pages:

This returned login.php and portal.php (both initially returning 302 redirects), as well as robots.txt.

Step Three — Portal Access and Command Execution

Navigating to login.php and using the credentials R1ckRul3s:Wubbalubbadubdub logged me into the portal, which redirected to portal.php.

The portal exposed a command execution panel — essentially a web shell — that accepted Linux commands. Running ls in the panel revealed two interesting files in the current directory:

Attempting cat Sup3rS3cretPickl3Ingred.txt failed — the application had blacklisted the cat command. I used tac instead (which prints file contents in reverse line order but still outputs the full content for single-line files):

Ingredient 1: mr. meeseek hair

clue.txt hinted to look around the filesystem for the remaining ingredients.

Step Four — Second Ingredient

I enumerated the home directory:

This showed two users: rick and ubuntu. Inside rick's home directory:

A file named second ingredients (note the space) was present. I read it with tac:

Ingredient 2: 1 jerry tear

Step Five — Third Ingredient (Privilege Escalation)

I checked the sudo permissions for the current user (www-data):

The output showed that www-data could run all commands as root with no password required:

No privilege escalation exploit was needed — I could simply prefix any command with sudo. I listed the root directory:

This revealed 3rd.txt. I read it with:

Ingredient 3: fleeb juice