Pickle Rick
Task 1 - Deploy the machine
🎯 Target IP: 10.10.150.53
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
This Rick and Morty-themed challenge requires you to exploit a web server and find three ingredients to help Rick make his potion and transform himself back into a human from a pickle.
Deploy the virtual machine on this task and explore the web application: 10.10.150.53
You can also access the web application using the following link: https://10-10-150-53.p.thmlabs.com (this will update when the machine has fully started)
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
Seeing html source page we found this precious info about username
2.1 - What is the first ingredient that Rick needs?
Try to scan open ports is always a good solution:
We know username and IP and we can try to access with SSH port
Nothing to do: Permission denied!
We can try to explore potential directory of website using gobuster
We visit /robots.txt and we found this info (maybe password)
Since we didn't find any login pages, let's try using nmap's http-enum script
Good news, we found login.php page
Inserting user and psw found into index.html source code: R1ckRul3s and robots.txt: Wubbalubbadubdub, we give access!
Now, we have a command panel, where we can launch our commands.
Using whoami we check that we're www-data user, with the ls command we explore the current directory where we find the first flag
Cat command doesn't work, for this reason we use "less" command to read flag
2.2 - What is the second ingredient in Rick’s potion?
Reading clue.txt file we found another important info
Exploring file system we found the 2nd ingredient
2.3 - What is the last and final ingredient?
Usually the last flag is in the protected/root folder, we try to find it
Last updated