October 14, 2026

Pickle Rick: TryHackMe Walkthrough

This time, we’re working on the Pickle Rick room on TryHackMe. The objective is to find three ingredients hidden across a web server and…

By Safeer Husain Zaidi

2 min read

This time, we're working on the Pickle Rick room on TryHackMe. The objective is to find three ingredients hidden across a web server and its filesystem.

The approach is straightforward: enumerate the target, discover credentials, access the command panel, and explore the filesystem to retrieve all three ingredients.

Step 1: Setting Up the Environment

I launched the TryHackMe room, started the target machine, and obtained its IP address.

export IP=<TARGET_IP>

I checked connectivity and opened the target in the browser.

ping -c 4 "$IP"

Open http://<TARGET_IP> in your browser to inspect the website.

Step 2: Discovering the Username

The homepage didn't reveal much initially, so I inspected its HTML source code.

This revealed a username:

R1ckRul3s

Next, I scanned the target using Nmap.

nmap -sC -sV -p- "$IP"

The scan identified SSH and HTTP among the exposed services.

Step 3: Finding the Password

I used Feroxbuster to discover additional files and directories.

feroxbuster -u "http://$IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt

I also checked robots.txt, which revealed a string that turned out to be the password.

curl "http://$IP/robots.txt"

Credentials discovered:

  • Username: R1ckRul3s
  • Password: Wubbalubbadubdub

The /assets directory was also accessible, but it wasn't the main lead.

Step 4: Accessing the Rick Portal

During enumeration, I identified /login.php and opened it in the browser.

I used the credentials discovered earlier to log in successfully. The portal provided a command panel that allowed commands to be executed on the target.

I started by listing the available files.

ls -la

Among the results was Sup3rS3cretPickl3Ingred.txt.

Step 5: Finding the First Ingredient

The portal restricted certain commands, including cat. I tried less as an alternative.

less Sup3rS3cretPickl3Ingred.txt

This revealed the first ingredient:

Mr. Meeseek hair

Step 6: Finding the Second Ingredient

I checked the clue file for the next step.

less clue.txt

The clue suggested exploring the filesystem. I listed the home directory and inspected Rick's files.

ls /home
ls -la /home/rick

I found the file containing the second ingredient and read it using:

less "/home/rick/second ingredients"

The second ingredient was:

1 jerry tear

Step 7: Checking Sudo Permissions

The final ingredient was located in the root directory. I checked the privileges available to the web application user.

sudo -l

The output showed that the user could execute commands as root without a password.

This misconfiguration provided a direct way to access the final ingredient without needing a separate privilege-escalation exploit.

Step 8: Finding the Final Ingredient

I listed the contents of the root directory using sudo.

sudo ls -la /root

The output revealed 3rd.txt.

I then read the file:

sudo less /root/3rd.txt

The final ingredient was:

Fleeb juice

All three ingredients were found, completing the TryHackMe room.

Key Takeaways

  • Source code inspection: HTML comments can expose usernames and other useful information.
  • Web enumeration: Files such as robots.txt can reveal sensitive clues.
  • Command execution: An insecure command panel can expose server-side functionality.
  • Sudo misconfiguration: Unrestricted passwordless sudo permissions can allow a low-privileged user to execute commands as root.
  • File permissions: Proper access controls are essential for protecting sensitive files.

Final Thoughts

This room demonstrates how a few small security weaknesses can lead to significant compromise.

A username exposed in the source code, a password hidden in robots.txt, and unrestricted sudo permissions were enough to retrieve all three ingredients.

The main lesson is simple: never underestimate information disclosure or misconfigured permissions. Small oversights can create much bigger security problems.

This walkthrough was performed in a controlled TryHackMe lab environment. Only test systems you have authorization to assess.