Swsctfjournal3

Topic: Pickle Rick

This is a fun and short ctf challenge based on the Rick and Morty characters. It involves basic web exploitation and enumeration.

Penetration Testing Methodology

• Network scanning (nmap scan)

• Enumeration
  • enumerating http service
  • extracting username from source codetry
  • directory bruteforce using dirb
  • extracting password from robots.txt
  • logging into the web application
• Exploitation
  • exploiting command module
  • invoking reverse shell
  • extracting first and second ingredients
  • enumerating rick’s file
• privelege excalation

Walkthrough

Run a TCP nmap scan

The scan reveals that the target machine has 2 open ports: 22 and 80.

Enumerating the http service

I inspected the source code of the web page and found a username: R1ckRul3s

Now i need to find hidden files or directories using gobuster

I found a hidden directory: /login.php. It takes us to a login page.

When i tried the /robots.txt path, i found a password: Wubbalubbadubdub

So i login with the credentials and found a command panel that allows me to execute commands.

We probably need to try and get a reverse shell. I tried to run a python reverse shell command but it didn’t work. So i tried to use the command module to get a reverse shell.

Also try to find the first and second ingredients.

When i tried to run a series of commands, like ls -la, i found a file named Sup3rS3cretPickl3Ingred.txt. I read the file and found the first ingredient.

Tried to get source php code to get all blacklisted commands by putting grep -R

source code

ls seems to not be blacklisted. Check for sudo privileges using sudo -l

I can run any command as sudo. So i ran sudo ls ../../../ to find the second ingredient.

Two flags found.

/home/rick/second ingredients: 1 jerry tear /root/third ingredients: fleeb juice

I got all the ingredients.