Pickle Rick

Info

• Platform: Tryhackme
• Machine Name: Pickle Rick
• Target IP/Host: 10.10.22.197
• OS / Version: Linux
• Difficulty / Category: Easy

Lab snapshot원본 이미지 보기 +

Overview

As a beginner for pentest, I decided to try solving some popular and easy machines on tryhackme. Today I chose ‘Pickle Rick’.

This is a simple and straightforward machine where the main concept appears to be reverse shell exploitation.

Recon & Enumeration

I scanned machine and found two open ports: 22(SSH), 80(HTTP), I decided to check out the webpage first.

Looking at the website, it seems I need to logon Rick’s computer and find three ingredients (flag).

I inspected the page source code and found what appears to be Rick’s username.

And I checked robots.txt and found an interesting string.

Since I couldn’t found any other useful information on this website, I started directory brute forcing and discovered login page.

I entered the username from the page source code and the password form robots.txt, and successfully logged in.

There was a command panel where I could execute system command.

However, I was unable to view any files using this command panel.

Initial Access

I tried to use reverse shell script written in sh (opened listening port on my system first), but it doesn’t work.

Since sh wasn’t working, I checked if python3 was available by running ‘which python’ and found python3.

I found python reverse shell script online and successfully executed it.

To get more stable shell environment, I upgrade it to a fully interactive TTY.

And I found the first flag in the /var/www/html directory.

Checked Rick’s home directory and discovered second flag.

Privilege Escalation

I suspected that the last flag would be in the root directory, so I checked sudo permissions using ‘sudo -l’.

I found ‘NOPASSWD: ALL’ in the sudo configuration, which allowed me to easily escalate privileges and obtained last flag from the root directory.

Conclusion

I learned that there are various types of reverse shells available, and when one doesn’t work, it’s important to try different scripts rather than giving up after the first attempt.