This Rick and Morty-themed challenge requires you to exploit a web server and find three ingredients to help Rick make his potion and transform himself back into a human from a pickle.

Reconnaissance

Started with Nmap scan:-

sudo nmap -sVC -p- -A -Pn 10.49.172.49 -T5 -oN nmap_scan.txt -v

Added ip to /etc/hosts by sudo nano /etc/hosts

Nmap scan result:-

Found ssh(22) and http(80) port open

Found a web server at port 80

Checked the source page and found username in comments.

username:- R1ckRul3s

Enumeration

Directory Bruteforce found assets directory but nothing interesting.

DIRECTORY + FILE BRUTEFORCE found something interesting.

Found a login.php login page.

Tried login with the username we got that is R1ckRul3s with both username and password field with R1ckRul3s but failed.

Lets see whats present in robots.txt those who don't know robots.txt its a public file that tells search engines which parts of a website to avoid but for us, it often reveals hidden or sensitive paths worth checking.

On checking robots.txt we got something interesting as Wubbalubbadubdub

Hey maybe this would be password?

Lets try Wubbalubbadubdub in the password of /login.php

Initial Access

And we successfully logged in! with R1ckRul3s:Wubbalubbadubdub we got redirected into /portal.php

Here we found a Command Panel so lets play with it! and found command injection.

I tried to list the files and folders and it worked.

Exploitation

lets try getting a RCE from this so lets check and confirm that does python3 is installed on the target using which python3 so that we will send python reverse shell payload.

lets generate a python3 reverse shell from revshells.com and setup a listener

Then lets invoke our reverse shell command.

And we got a reverse shell.

After listing files and folder got a file named Sup3rS3cretPickl3Ingred.txt after reading it we got our first answer that first ingredient that Rick needs.

Lets enumerate more…

we tried to read clue.txt and found a message Look around the file system for the other ingredient.

And after little enumeration we got second ingredient at /home/rick

After little enumeration we got another user directory at /home called ubuntu we tried ls to read files and directories but it showed nothing, so we tried to list hidden files and directories using ls -a and found .bash_history we tried to read but we don't have any permission.

Privilege escalation

We checked what permission we have using sudo -l and found that we can run any command as root (or any user) without needing a password. so we loggedin as root by sudo suand now we are root user

Now lets try to read that .bash_history file as before we didn’t have any permission to read.

And we successfully found the 3rd ingredients.

🔗 Connect With Me

🤝 LinkedIn