THM Room: Pickle Rick CTF
Last updated
Last updated
This Rick and Morty themed challenge requires you to exploit a web server to find 3 ingredients that will help Rick make his potion to transform himself back into a human from a pickle.
Deploy the virtual machine on this task and explore the web application: MACHINE_IP
You can also access the web app using the following link: https://lab_web_url.p.thmlabs.com/ (this will update when the machine has fully started)
Operating System: Ubuntu
There are two open ports in the system, one has a ssh service running and the other have a http service running on it. The ssh service used for remote login and management of the server that required username and password pair or a private key for a successful login. We cannot have either of them right now so we move on to http service right now. HTTP is a protocol that is used by the webserver to serve a web page. From our scanning, we see they are using a Apache web server and which means they are hosting some web pages.
When browsing the website from this link http://10.10.12.75 we see a static page and when I see its source code by pressing CTRL + U the key in my Firefox browser I see there is a comment in its source code that is following.
Website often have a file name robots.txt that tells the search engine crawlers not to crawl the mentioned endpoints in this file. This website also has this file and they have the following thing in it.
The robots.txt file syntax are not like this, they are like following
But this webserver file is not like that so that means it's something else, we just keep that in our notes right now.
We didn't find any reference to any other pages on the site so to increase our attack scope we are doing Directory Fuzzing or Content discovery to find some hidden directories and files. The hidden directories and files are those directories and files that exist in the web server's root directory the website doesn't show any reference to them on its page. To find that directories and files we do fuzzing in which we have a wordlist of common directories and file names and we send lots of requests to the server that has the directories and files name. We do that using tools like ffuf, gobuster, and Burp suite, etc. We also refer to isit as Content Discovery.
Using the ffuf a tool with the above command I found that files in which we found /assets the directory that has some common files like css and js file, robots.txt, and a login.php that we also see in nikto scan result let's visit it.
We see they have a login page in which they required a username and password. We have found one username but we didn't have any password we can try to bruteforce it but before that let's try the string we found in robots.txt.
It works and they give us the successful login and redirected us to /portal.php. They give us some command execution portal in which we can execute system commands. We love to see this!
We can use simple commands ls to list all the current working directory files we see a file name Sup3rS3cretPickl3Ingred.txt. Use cat to view the content of that file. When we submit that they didn't give us any output look like they add some blacklist for the command. There are some other commands that are used to see the content of a file i.e more, head, tail, less etc let's use that and which one will work fine. One of them worked and we successfully get the content of that file to submit it to tryhackme.
Note: We didn't need a reverse shell to solve this room. Just the sake of methodology I use this method to solve that room.
We have a command execution now let's try to get a reverse shell. Start a listener on your attacking machine with netcat or a pawncat whatever method you like I use the netcat listener with the following command.
Unfortunately, after trying some basic bash reverse shell payload I can't get the reverse shell.
After trying another reverse shell payload I eventually got a connection back. The following reverse shell payload worked for me.
This gives me a reverse shell but this is only a replica of the web shell in your terminal this is not a normal shell but there you can use all commands that are blacklisted like cat, more, head.
Now we can try to find other ingredient, first, check in the home directory and there is a user home directory /home/rick that has the second ingredients file.
Note: That file another ingredienthave spaces in there name so use the quotes in the command for see that file content like the following command
Now use the following command to get all the binaries with suid permission set so we can use that to get a elevated permission.
They show me the following result
There we didn't see any useful method to get easy privilege escalation. The next thing we can try is to use sudo -l command and see if we can use any command with sudo there we see we can run all commands as sudo with NO PASSWORD. Knowing that we can use the following command to list all the content of /root directory.
After using the above command we came to know there is a file with the name 3rd.txt so just use the following command and see the content of the 3rd ingredient
Here we find all the ingredient
Q: What is the first ingredient Rick needs?
Q: What's the second ingredient Rick needs?
Q: What's the final ingredient Rick needs?
