> For the complete documentation index, see [llms.txt](https://rudolfevergarden.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rudolfevergarden.gitbook.io/writeups/tryhackme-writeups/tryhackme-writeups/pickle-rick-room-tryhackme.md). # Pickle Rick Room TryHackMe This Rick and Morty themed challenge requires you to exploit a webserver to find 3 ingredients that will help Rick make his potion to transform himself back into a human from a pickle. Pickle Rick Room TryHackMe ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2Fq0gh3kwxul7kC0bEx0ev%2F0?alt=media) Room initial view ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FM3A5voIMgwf7DIWwf42y%2F1?alt=media) The questions given in the room to be solved ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FVYaD88EM5BQoCG6faptr%2F2?alt=media) Opened the attack box ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2Fs1pep2QFWalWi6mbYFrT%2F3?alt=media) Visiting the site ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2Fwm32eNM1jLJ9CgLXb6N2%2F4?alt=media) Checking the source code of the site ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FwwzF0qL1BNGdRjT2Sn5Q%2F5?alt=media) Got the Username: R1ckRul3s. But where to login. Hmm ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FuC5SCIKQ3KGgSMwGJgiw%2F6?alt=media) Searched for the login page. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FbCHzul4RdmeyTmM7MeQg%2F7?alt=media) The login page exists. Well the rick forgot the password. Now its time for us to find the password and login to find the three ingredients and help Rick. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FtiPrjrTNQYta0mv7s8he%2F8?alt=media) Tried few passwords manually but no luck. I was wondering if there were any other pages that the login page so i ran Gobuster in my Kali Linux VM. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2Fj9REszO7UjIlpCE0TSj3%2F9?alt=media) after sometime we found few of the directories in the site. I stopped the gobuster and started looking at the robots.txt file. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2F7dwZV5mPfGZairFbQ1Mg%2F10?alt=media) Found something after opening the robots.txt page. this is interesting It might be the password lets give it a try with the username we found. `username: R1ckRul3s` `pass: Wubbalubbadubdub` ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FVrsg5kXbeNgpswplzkYO%2F11?alt=media) Seems like this was the password after all and we got into the site. The site had a page called commands so i typed to check if the linux commands are working. So, i typed ls and hit enter. When typed ‘ls’ we got ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FHEW0TQ1PwBAIQPU1VTeI%2F12?alt=media) now lets see what's in side of the files lets use cat command as usual ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FlDcx7lEGuZOSEATkkg1G%2F1.gif?alt=media\&token=62a30d62-50ce-4c1f-9569-88f8ea8e92d7) seems like the cat command is blocked. lets try another way to view the content in the file. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2F1zciGpVjmBTGtX31Poj9%2F2.gif?alt=media\&token=e267a780-d383-4496-bd21-3b3b6e5def92) well the less command is working and we can see the content in the file. This might be our First ingredients needed. now i searched for see other content but not possible. so i tried to get a reverse shell using python3. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2F4jQhMbuUqTl9ajMrt9dM%2F13?alt=media) Reverse shell from pentest monkeys. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FGcya3w8IKd4quw0iPFUD%2F14?alt=media) Reverse shell success After shell success Stabilize the shell {% embed url="" %} after the shell is stable i tried sudo su command to check if root user is enabled and voila i got the root user. Then in navigated to home directory to find the second ingredient. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2F4WQML4Ma5IQtl1bIdaXT%2F15?alt=media) after getting the second ingredient i navigated to root and found the third ingredient. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FNFf1bYvXMFafOu2qL23q%2F16?alt=media) and that's the final ingredient we needed. with this all the ingredients have been gathered. ![](https://2240550458-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU6VlWgI4YUN8NX1pkK7v%2Fuploads%2FnvtVBtgaFql2E6IQnVwo%2Fimage.png?alt=media\&token=18a44c5d-85e0-40e5-bfc8-0142434ff3c5) and we solved the room. until next time.