# TryHackMe Writeup: Pickle Rick

**Room:** <https://tryhackme.com/room/picklerick>

**Objective:** Find three secret ingredients hidden on the machine.

---

## Scanning

Started with an nmap scan to enumerate open services on the target.

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/87958a21-e0b2-4604-a8e3-a5a99d6ccc90.png align="center")

## Enumeration

Inspected the web server running on the machine. The page hinted at pickle (possible pickle deserialisation) and the word "reverse" suggesting a reverse shell would be needed later.

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/ee5e348c-299f-4fe3-b36c-c2f5dcea4c15.png align="center")

Ran a **gobuster** scan to discover hidden directories and pages on the web server.

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/610019ae-66cb-48ac-a279-7a4cae5e2e32.png align="center")

**Source code / curl inspection** revealed a username embedded in the page:

- Username: `R1ckRul3s`

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/005923bf-52f1-4fdf-bf91-3c714a9be431.png align="center")

Checking `robots.txt` returned:

- `Wubbalubbadubdub`

## Exploitation

Tried `Wubbalubbadubdub` as the password for the login panel and it worked.

---

### Command Panel : Ingredient 1

The login led to a command execution panel. Running `ls` showed the files in the web root, including the first ingredient file.

`cat` was disabled, but `less` was not:

```bash
less Sup3rS3cretPickl3Ingred.txt
```

**Ingredient 1:** `mr. meeseek hair`

---

### Home Directory : Ingredient 2

Browsing `/home/rick/` revealed a file with a space in its name. Used a wildcard to read it:

```bash
less /home/rick/*
```

> Alternatively, for files with spaces in their names, wrap the path in single quotes so the shell treats it as one argument.

This gave the second ingredient.

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/c0d4c3db-8969-44e6-9f15-14b619de7eb2.png align="center")

**Ingredient 2:** `1 jerry tear`

---

### Reverse Shell : Ingredient 3

To find the third ingredient (likely in `/root`), a reverse shell was needed.

**Tip:** To find your attack box IP from the target machine:

```bash
ip route <attack-box-ip>
```

The output will show your machine's IP in the hop results.

Tried several reverse shell payloads from <https://www.revshells.com/> until one worked. Set up a listener and caught the shell.

Checked sudo privileges:

```bash
sudo -l
```

All commands could be run as sudo (no password required). Escalated to root:

```bash
sudo su
```

Then read the third ingredient from `/root/3rd.txt`

**Ingredient 3:** `fleeb juice`

![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/650436f2-0435-4e37-a60c-282af8452bd0.png align="center")

Technically, you don't need a reverse shell here. You can just type `sudo -l` in the command panel and proceed the same way with the rest. We have tried a reverse shell here just for the sake of the room's theme.

---

### Summary

| Step | Finding |
| --- | --- |
| Source code inspection | Username: `R1ckRul3s` |
| `robots.txt` | Password: `Wubbalubbadubdub` |
| Command panel (`less`) | Ingredient 1: `mr. meeseek hair` |
| `/home/rick/` | Ingredient 2 |
| Reverse shell + `sudo su` | Ingredient 3 (root directory) |