Pickle Rick CTF

TryHackMe walkthrough / Web Server Exploitation

1. Reconnaissance with Nmap

We start by scanning the target machine to identify open ports and running services.

Using Nmap:
We will use the command: nmap <TARGET_IP>

Results:

• Port 22 → SSH
• Port 80 → HTTP (Web Server)

2. Web Enumeration (Port 80)

Navigate to: http:/TargetIp in the browser.
Let's investigate the source code and see what we can find out!

Source Code Inspection

Viewing the page source reveals a hidden comment (around lines 28–34):

Username: R1ckRul3s

While reviewing the HTML, another interesting observation is the assets directory, which may contain additional hidden resources worth exploring.

3. Checking for robots.txt

Next, we check for common misconfigurations like robots.txt:

http://<TARGET_IP>/robots.txt

This reveals a hidden string:

Wubbalubbadubdub

We note this as a potential password.

We also confirm it via terminal:

curl http://<TARGET_IP>/robots.txt

Just to recap:
We have found a username and a possible password:

• Username: R1ckRul3s
• Possible password: Wubbalubbadubdub

4. Directory Enumeration with Gobuster

To discover hidden directories and files, we use Gobuster:

gobuster dir -u http://<TARGET_IP> \
-x php,html,css,js,txt,pdf \
-w /usr/share/wordlists/dirb/common.txt

Breaking down this command:
gobuster dir = tells gobuster to brute-force web directories and files.

• u is the URL flag (This tell gobuster to scan this url.
• w is the wordlists this file contains thousands of general directory/ file names.
• x is to try different extensions such as php, html,js,css, and txt.

Findings:

Among the discovered endpoints, we find a login page:

/login.php

5. Logging Into the Portal

We attempt login using the credentials gathered:

• Username: R1ckRul3s
• Password: Wubbalubbadubdub

Success — We’re In!

After logging in, we are presented with a command execution interface.

I tested a simple Linux command and had a successful response with a list of files.

6. First Flag (Ingredient 1)

We start by listing files:

ls

The file Sup3rS3cretPickl3Ingred.txt sounds interesting. Let's see if we can open that.

Attempting:

cat Sup3rS3cretPickl3Ingred.txt

fails due to command restrictions.

However, using an alternative command works:

less Sup3rS3cretPickl3Ingred.txt

Why less works:

Some restricted shells block cat but still allow paging utilities like less, more, or tac because they are separate binaries and sometimes not filtered.
Flag 1 obtained!!!

FLAG 2
7. Second Flag (Ingredient 2)

A clue.txt file is discovered. We inspect it using:

tac clue.txt

Output:

Look around the file system for the other ingredient.

This hints that we need to explore system directories.

Checking /home

ls /home

We find:

• rick
• ubuntu

Ubuntu seems to be a standard Linux directory but rick is definitely a user.

Inspecting further:

ls -l /home/rick

We see:

second ingredients

Because of the space in the filename, normal commands fail, so we escape it:

cat /home/rick/second\ ingredients

This command did not work. I tried something else:

Get Rormsbee’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

tac “/home/rick/second ingredients”

Flag 2 obtained

8. Privilege Escalation (Final Flag)

We check our current user:

whoami

Output:

www-data

This confirms we are a low-privileged web user.

Checking sudo permissions

sudo ls -al /root/

We discover a file:

3rd.txt

Since sudo is allowed without a password, we read it:

sudo tac /root/3rd.txt

Flag 3 obtained!!

NOTES POST CTF

OVERVIEW & CONTEXT

Date: 05–19–26
Tester: RYAN
System: Pickle Rick CTF (Web Application Exploit)

Scope:

• Target web server (HTTP on port 80)
• SSH service (port 22) identified but not utilized in attack path
• Web application including:
• Login portal
• Command execution interface
• Local filesystem access via web shell

ARCHITECTURE & SYSTEM FLOW

Data Flow:

User (Attacker)

↓ HTTP (Port 80)

Web Application (Login Portal / Command Interface)

↓

Server-side Shell Execution Layer (www-data context)

↓

Linux File System (/home, /root, application directories)

DATA CLASSIFICATION

• ☒ PII / PCI / PHI — Sensitive / restricted system data exposed
• Includes:
• Credentials
• Local system files
• Root-level content

AUTHENTICATION & AUTHORIZATION

Authentication:

• Web-based login form
• Credentials obtained via:
• HTML source code leakage
• robots.txt enumeration

Credentials Identified:

• Username: R1ckRul3s
• Password: Wubbalubbadubdub

Authorization:

• No Role-Based Access Control (RBAC) enforcement post-login
• Authenticated session grants direct OS command execution via web interface
• Effectively operates as a remote command execution (RCE) endpoint

SECURITY CONTROLS EVALUATED

• ☒ Identity & Access Management (IAM): Weak
• No role separation after authentication
• Over-privileged command execution interface
• ☒ Vulnerability & Patch Management: Poor
• Exposed services and insecure configuration present
• Multiple attack surfaces accessible via web enumeration
• ☒ Logging & Monitoring: Not observed
• No evidence of command auditing or activity monitoring
• No detection of suspicious command execution behavior

REMEDIATION PLAN

• Remove sensitive data from frontend source code (HTML comments, client-side exposure)
• Eliminate credential leakage via public files (e.g., robots.txt must not contain secrets)
• Implement secure credential storage (hashed + salted passwords, secure vaulting)
• Enforce secure code review prior to deployment
• Implement proper RBAC for authenticated users
• Restrict or remove web-based command execution functionality
• If command execution is required:
• Use strict allowlists
• Apply sandboxing / containerization
• Enforce least privilege execution context
• Enable logging and monitoring for all authentication and command execution events

STATUS

• ☒ Lab / CTF Environment (Non-production)
• ☒ Findings used for educational penetration testing practice