Summary
This Rick and Morty-themed challenge requires you to exploit a web server and find three ingredients to help Rick make his potion and transform himself back into a human from a pickle. Reconnaissance Started with Nmap scan:- sudo nmap -sVC -p- -A -Pn 10.49.172.49 -T5 -oN nmap_scan.txt -v Added ip to /etc/hosts by sudo nano /etc/hosts Nmap scan result:- Found ssh(22) and http(80) port open Found a web server at port 80 Checked the source page and found username in comments. username:- R1ckRul3s Enumeration Directory Bruteforce found assets directory but nothing interesting. DIRECTORY + FILE BRUTEFORCE found something interesting. Found a login.php login page. Tried login with the username we got that is R1ckRul3s with both username and password field with R1ckRul3s but failed. Lets see whats present in robots.txt those who don’t knowrobots.txt its a public file that tells search engines which parts of a website to avoid but for us, it often reveals hidden or sensitive paths worth checking. On checking robots.txt we got something interesting as Wubbalubbadubdub Hey maybe this would be password? Get Aniket Nayak’s stories in your inbox Join Medium for free to get updates from this writer. Lets try Wubbalubbadubdub in the password of /login.php Initial Access And we successfully logged in! with R1ckRul3s:Wubbalubbadubdub we got redirected into /portal.php Here we found a Command Panel so lets play with it! and found command injection. I tried to list the files and folders and it worked. Exploitation lets try getting a RCE from this so lets check and confirm that does python3 is installed on the target using which python3 so that we will send python reverse shell payload. lets generate a python3 reverse shell from revshells.com and setup a listener Then lets invoke our reverse shell command. And we got a reverse shell. After listing files and folder got a file named Sup3rS3cretPickl3Ingred.txt after reading it we got our first answer that first ingredient that Rick needs. Lets enumerate more… we tried to read clue.txt and found a message Look around the file system for the other ingredient. And after little enumeration we got second ingredient at /home/rick After little enumeration we got another user directory at /home called ubuntu we tried ls to read files and directories but it showed nothing, so we tried to list hidden files and directories using ls -a and found .bash_history we tried to read but we don’t have any permission. Privilege escalation We checked what permission we have using sudo -l and found that we can run any command as root (or any user) without needing a password. so we loggedin as root by sudo su and now we are root user