TryHackMe: Pickle Rick CTF Walkthrough

Welcome to my latest CTF write-up! As part of my journey into penetration testing, I regularly tackle machines on TryHackMe to sharpen my skills. Today, I'll be taking you through my process of solving the "Pickle Rick" room.

This CTF is a fantastic, beginner-friendly machine that focuses on web enumeration, bypassing command filters, and simple Linux privilege escalation. Let's dive right into how I rooted it!

1. Reconnaissance & Enumeration

Whenever I start a new box, the first step is always to figure out what we are dealing with. I scanned the target IP using Nmap to map out the attack surface. I found out that two ports were open: port 22 (SSH) and port 80 (HTTP).

Seeing port 80 open meant there was a web server running, so I immediately checked out the webpage hosted on the target IP in Firefox. At first glance, I just found a standard index page with some Rick and Morty graphics.

However, in web exploitation, you always have to look under the hood. I checked the page source of the website and, luckily, I found a username hidden right there in an HTML comment!

I kept looking around for standard web files. A great place to check for hidden paths is robots.txt. When I navigated there, I found a random string of text. I didn't know the exact purpose of it at the time, but I copied it to my notes just in case.

Next, I needed to find a place to actually use the username I found. I fired up Gobuster to look for any hidden directories or login portals. The scan successfully uncovered a login.php page. Now we were getting somewhere.

2. Exploitation & Initial Access

I navigated to login.php and plugged in the username I found in the source code. For the password, my initial instinct was to fire up Hydra or Burp Suite to start brute-forcing it.

But then I remembered the random string I had found earlier in robots.txt. In CTFs, nothing is placed by accident. I decided to try that string as the password, and sure enough, I got signed in!

After logging in, I was presented with a homepage that featured a web-based command execution panel. Simply to check it out and see if it was actually executing system commands, I entered ls. It worked! The output listed the contents of the current web directory, and I spotted two very interesting files: Sup3rS3cretPickl3Ingred.txt and clue.txt.

3. Post-Exploitation & Bypassing Filters

Now that I had command execution, I wanted to read those files. I tried using the standard cat command, but it didn't work. The web application had some sort of input sanitization or filter that was blocking the word cat.

When doing penetration testing, if one tool gets blocked, you find another way. I tried using an alternative command to read files: less. Fortunately, this completely bypassed the filter!

First, I opened Sup3rS3cretPickl3Ingred.txt and got the answer for the 1st question. Then, I looked into clue.txt and found a clue pointing me toward the next steps.

4. Privilege Escalation to Root

With the first ingredient down, I started exploring the rest of the file system. I ran ls /home and found two user directories. The rick directory looked like the most obvious target, so I ran ls /home/rick and found the 2nd ingredient sitting right there.

Now I just needed the final answer. Generally, the final flag in these CTFs is located securely inside the /root directory, meaning I needed to elevate my privileges.

To check what my current user was allowed to do, I ran sudo -l. This is a standard post-exploitation check to see if we can run any commands as the root user without needing a password. It turned out I did have permission to use sudo for everything!

Because I had full sudo privileges, I simply ran sudo ls /root to see what was inside the root directory. I saw the final file, used my less trick one more time (sudo less /root/[filename]) to read it, and successfully found the final ingredient.

Conclusion

The Pickle Rick room is successfully completed! This was a really fun, straightforward box that highlights the importance of thorough web enumeration — like checking source code and robots.txt—and thinking outside the box when standard commands like cat are blocked.

Thanks for reading my write-up!