TryHackMe Writeup: Pickle Rick

Room: https://tryhackme.com/room/picklerick

Objective: Find three secret ingredients hidden on the machine.

---

Scanning

Started with an nmap scan to enumerate open services on the target.

Enumeration

Inspected the web server running on the machine. The page hinted at pickle (possible pickle deserialisation) and the word "reverse" suggesting a reverse shell would be needed later.

Ran a gobuster scan to discover hidden directories and pages on the web server.

Source code / curl inspection revealed a username embedded in the page:

• Username: R1ckRul3s

Checking robots.txt returned:

• Wubbalubbadubdub

Exploitation

Tried Wubbalubbadubdub as the password for the login panel and it worked.

---

Command Panel : Ingredient 1

The login led to a command execution panel. Running ls showed the files in the web root, including the first ingredient file.

cat was disabled, but less was not:

less Sup3rS3cretPickl3Ingred.txt

Ingredient 1: mr. meeseek hair

---

Home Directory : Ingredient 2

Browsing /home/rick/ revealed a file with a space in its name. Used a wildcard to read it:

less /home/rick/*

Alternatively, for files with spaces in their names, wrap the path in single quotes so the shell treats it as one argument.

This gave the second ingredient.

Ingredient 2: 1 jerry tear

---

Reverse Shell : Ingredient 3

To find the third ingredient (likely in /root), a reverse shell was needed.

Tip: To find your attack box IP from the target machine:

ip route <attack-box-ip>

The output will show your machine's IP in the hop results.

Tried several reverse shell payloads from https://www.revshells.com/ until one worked. Set up a listener and caught the shell.

Checked sudo privileges:

sudo -l

All commands could be run as sudo (no password required). Escalated to root:

sudo su

Then read the third ingredient from /root/3rd.txt

Ingredient 3: fleeb juice

Technically, you don't need a reverse shell here. You can just type sudo -l in the command panel and proceed the same way with the rest. We have tried a reverse shell here just for the sake of the room's theme.

---

Summary

Step	Finding
Source code inspection	Username: R1ckRul3s
robots.txt	Password: Wubbalubbadubdub
Command panel (less)	Ingredient 1: mr. meeseek hair
/home/rick/	Ingredient 2
Reverse shell + sudo su	Ingredient 3 (root directory)