TryHackMe — Pickle Rick — Atharva Kulkarni

1. Recon — The Login Wall

The web root presents a Rick and Morty page with a login portal. No credentials are given. The first move in any web assessment is to read what the server is willing to tell us for free: the page source and well-known files.

Username in the HTML source

Viewing the page source reveals a developer note left in an HTML comment — the username.

Password in robots.txt

Checking /robots.txt surfaces a single suspicious string — the password.

$ curl http://TARGET/robots.txt Wubbalubbadubdub

Source	Value Found	Role
HTML comment	R1ckRul3s	Username
/robots.txt	Wubbalubbadubdub	Password

2. Foothold — The Command Panel

Logging in with R1ckRul3s / Wubbalubbadubdub lands on /portal.php, which exposes a command execution panel. This is effectively a web shell running as the web service user — arbitrary Linux commands can be run against the host.

# Confirm execution and identity $ whoami www-data $ ls -la Sup3rS3cretPickl3Ingred.txt clue.txt ...

3. Ingredients 1 & 2 — File Reads

The first ingredient sits in a file in the web directory. cat on some commands is filtered, so a substitute such as less or grep reads it. The second ingredient is elsewhere on the filesystem — find locates it, and a read returns it.

# Ingredient 1 $ less Sup3rS3cretPickl3Ingred.txt mr. meeseek hair # Ingredient 2 (Rick's home directory) $ find / -name "second*" 2>/dev/null /home/rick/second ingredients $ cat /home/rick/'second ingredients' 1 jerry tear

4. Ingredient 3 — Privilege Escalation via sudo

The final ingredient lives in /root, which www-data cannot read. Checking sudo rights reveals the misconfiguration that ends the box.

$ sudo -l User www-data may run the following commands on this host: (ALL) NOPASSWD: ALL

(ALL) NOPASSWD: ALL means the web user can run any command as root without a password. Reading the root directory becomes trivial.

$ sudo ls /root 3rd.txt $ sudo cat /root/3rd.txt <third secret ingredient>

Key Takeaways

Attacker Perspective

Developers routinely leave credentials in HTML comments and configuration files like robots.txt during development and forget to remove them before production. Always check source code and standard file locations before attempting anything complex.

Defender / Remediation

Audit HTML source before deployment — use automated secret scanning (git-secrets, TruffleHog). robots.txt is public by design. Never store credentials in it. Apply the principle of least privilege to all sudo rules.