Pickle Rick

1. Recon — The Login Wall

The web root presents a Rick and Morty page with a login portal. No credentials are given. The first move in any web assessment is to read what the server is willing to tell us for free: the page source and well-known files.

Username in the HTML source

Viewing the page source reveals a developer note left in an HTML comment — the username.

Password in robots.txt

Checking /robots.txt surfaces a single suspicious string — the password.

2. Foothold — The Command Panel

Logging in with redacted / redacted lands on /portal.php, which exposes a command execution panel. This is effectively a web shell running as the web service user — arbitrary Linux commands can be run against the host.

3. Ingredients 1 & 2 — File Reads

The first ingredient sits in a file in the web directory. cat on some commands is filtered, so a substitute such as less or grep reads it. The second ingredient is elsewhere on the filesystem — find locates it, and a read returns it.

4. Ingredient 3 — Privilege Escalation via sudo

The final ingredient lives in /root, which www-data cannot read. Checking sudo rights reveals the misconfiguration that ends the box.

(ALL) NOPASSWD: ALL means the web user can run any command as root without a password. Reading the root directory becomes trivial.

Key Takeaways