Rick and Morty Pickle Rick Try Hack Me Writeup

First I started by checking whether the target was reachable

then ran an Nmap scan to identify open ports and running services.

The scan revealed two open ports 22 for ssh and 80 for Apache

Since I didn't have any SSH credentials, I focused on the web server running on port 80.

The website had some text hinting at a login page and a password.

One of the first things I checked was the page source, looking for comments or other information that might have been left behind by the developer.

And I found this comment

That gave me the username, but I still needed the password. I used Gobuster to look for hidden directories and files.

The scan found several interesting paths, including /login.php, /portal.php, /assets, and /robot.txt.

I checked /robot.txt and found the string Wubbalubbadubdub.

Given the website's theme, it looked like a likely password, so I decided to try it. So I logged in to /login.php using the credentials I had found.

The login worked, and I was redirected to /portal.php, where I found a command panel that allowed me to execute commands on the server.

I started with ls to see what files were available.

Next, I tried reading clue.txt with cat, but the application blocked the command and displayed this message.

Rather than spending time on the blacklist, I tried the command less instead.

It worked, and I recovered the first ingredient.

I continued exploring the filesystem and found another file in Rick home directory.

I did the same thing with the command less but this time the file name is made of two words

After spending time searching for the 3rd ingredient I found out that I can't ls the /root directory.

So I checked the sudo permissions to see whether the current user could run commands with elevated privileges.

This was the most significant finding so far. The www-data user could run any command through sudo without providing a password, including commands as root.

And I tried to use the elevated privileges to retrieve the final ingredient in the /root directory

This lab highlighted a few important points.

First, checking the page source and robot.txt can reveal useful information, including usernames and potential passwords. These checks are simple, but they're worth doing early during web enumeration.

Second, blocking a single command such as cat is not an effective security measure. Because other utilities like less can perform similar file reading operations.

Finally, the NOPASSWD : ALL entry in the sudo configuration was the most serious issue I found. It allowed the web server account to execute commands as root without authentication. Combined with command execution through the web panel, this turned limited access into full system compromise.