Helping Rick find his ingredients: PICKLE RICK CTF

May 23, 2021

Hello Hackers,

Today we are going to solve the challenge PICKLE RICK by TRYHACKME.

So the story goes like this:

Our friend Rick has turned into Pickle [Really don't know how he ended up being a Pickle :P] and our goal is to find him 3 Secret ingredients so that he can go back to his original form.

Let's jump into the CTF.

First things first

CONNECT TO OPENVPN & DEPLOY THE MACHINE😂

We'll see this page as we put the IP address into our browser.

REMEMBER: Whenever you visit a webpage, don't forget to check the source code. Sometimes, developers leave sensitive information such as credentials in the form of comments.

You can either do Right-Click --> View page source or press Ctrl+u.

You'll see that the username is leaked in the source code of that page!

Now let's try to scan the ports and see if we find something interesting.

Command used: nmap -sV -A -T5 {ip}

You'll see that ports 22 & 80 are open.

Wait, can the username be for the ssh service?

Let's try it out.

Type ssh {username}@{ip}

You'll see that actually, it was not for ssh.

No worries, let's try to carry out directory brute force.

The tool used: ffuf

Command used: ffuf -w {path to wordlist} -u http://{ip}/FUZZ -mc 200,301

You can use any other tool such as Gobuster, dirb, etc.

We see that there are 3 directories available that are accessible.

Let's have a look at them

The index page is the same as the homepage that we saw.

Robots.txt

As you can see, that's surely not a normal robots.txt file because generally, it contains instructions for the pages that web crawlers are not allowed to crawl. This leads us to think that it might be the password!

Now we have the username as well as the password which makes it evident that there must be a login panel where we could put these credentials.

Let's check out the assets directory first and see if we find something interesting.

Nothing interesting in here :(

Coming back to the credentials, let's make some educated guesses about the name of the login panel.

It can be either login.html, sign in, admin.html, login.aspx, login.php etc.

You'll see that login.php is a correct guess.

You'll see a page like so.

Our NMAP results revealed that the webserver was Linux-based.

Let's try to execute some Linux commands.

Command used: ls

You'll see that there's a file named Sup3rS3cretPickl3Ingred.txt

Also, we have our assets directory here as well which means that our file is in the same directory as assets. So we put /Sup3rS3cretPickl3Ingred.txt after our IP address in the browser.