This TryHackMe lab activity, "Pickle Rick," is a

Capture The Flag (CTF)-style challenge focused on cybersecurity fundamentals1. It requires

you to exploit a target system to find three "ingredients" (flags) to help Rick get back to his
human form2.

Since the prompt asks for a step-by-step procedure to solve the problem, the following
outline provides the general methodology and steps typically required for this kind of
challenge.

🛑 Important Ground Rules: Remember that you must document every step with a
screenshot that clearly shows your custom Kali Linux username, and provide a concise
explanation for each finding3333. The techniques described below are for

educational purposes only within the controlled lab environment4.

Step-by-Step Procedure for THM Room: Pickle Rick

1. Initial Setup and Reconnaissance (Recon)

This stage involves finding the target's IP address and identifying open services.

Step Action Tool/Technique Goal

Start the
1.1 TryHackMe Platform Get the target machine's IP address.
Machine

Identify open ports, running services, and their

nmap -sC -sV <target-
1.2 Initial Scan versions. The -sC option runs default scripts, and -
ip>
sV probes for service versions.

Check HTTP Web Browser Access the main webpage to observe its content
1.3
Service ([Link] and structure.

2. Web Exploitation and Initial Flag Discovery

Based on the hints, the web page itself is the starting point for finding the first clue 5.

Step Action Tool/Technique Goal

This is
Look for commented-out
where
Examine Browser's "View Page information, developer notes, or
2.1 you'll find
Page Source Source" or curl unusual formatting that might reveal
the first
the first secret ingredient.
flag. 6666
Step Action Tool/Technique Goal

gobuster dir -u Scan the web server for hidden files

Directory
[Link] -w and directories using a common
2.2 Brute-
/path/to/wordlist (e.g., wordlist. The hints suggest looking
Forcing
dirb or ffuf) for hidden files/directories7.

Navigate to any interesting

directories found (e.g., a login page,
Investigate an admin page, or a strange file). A
2.3 Browser
Findings key file (often with credentials or a
command execution utility) is
typically found here.

3. Exploiting Vulnerability and Shell Access 🚪

This usually involves finding a way to execute commands on the target system.

Step Action Tool/Technique Goal

Use a discovered utility (like a command execution

Gain Web page feature
feature on a web page) to run basic Linux
3.1 Command (e.g., a "command
commands, such as ls or cat, to confirm code
Execution panel")
execution.

Set up a listener on your Kali machine, then use the

Command execution
Execute a command execution feature to send a script (like a
with a Netcat
3.2 Reverse Python or Netcat reverse shell payload) that forces
listener (nc -lvnp
Shell the target machine to connect back to your listener.
<port>)
This grants an interactive shell session.

Use commands like python -c 'import pty;

Stabilize the Python, stty
3.3 [Link]("/bin/bash")' to upgrade the basic shell
Shell commands
to a fully interactive TTY shell for better usability.

4. Finding the Second and Third Ingredients 🔍

Once you have a shell, you must search the file system for the remaining two flags8888.

Step Action Tool/Technique Goal

4.1 System Search ls, grep, find / - Search common locations for user This
(Flags) name "*flag*" files and application configurations for reveals
Step Action Tool/Technique Goal

files containing the word "flag" or

"ingredient." The second flag is the
2>/dev/null usually found in a common directory second
like the web server's root or a user's flag. 9999
home directory.

Look for configuration files, scripts, or

directories that might contain hidden
Search for usernames/passwords or other clues
4.2 ls -la, cat, grep
Credentials/Clues for privilege escalation10. A common
location for a clue is the user's home
directory.

5. Privilege Escalation (PrivEsc) and Final Flag 👑

This step involves finding a vulnerability that lets you move from a low-privilege user to the

root user, which holds the final ingredient11111111.

Step Action Tool/Technique Goal

Enumerate sudo -l, find / -perm -u=s -type f Check for low-hanging
5.1
Privileges 2>/dev/null fruit:

* **`sudo -l`**: See if the current user can run any commands as root without a password.

* **SUID/SGID Binaries**: Look for files with the SUID bit set, which allows a user to run an
executable with the permissions of the file owner (often **root**). |

| 5.2 | Exploit Privilege Misconfiguration | sudo or a vulnerable SUID binary | If a command

can be run with root privileges (e.g., a text editor like vim or a utility like less), use it to gain a
root shell. Consult resources like GTFOBins for specific exploit methods. |

| 5.3 | Retrieve Final Flag | cd /root, ls, cat | Once you have a root shell, navigate to the
/root directory, which is typically where the final administrator flag resides.

This reveals the third flag. 12121212 |

Submission Requirements

Ensure your final PDF report, named

YourName_PickleRick_Lab1.pdf13, includes:
  Screenshots: One for every step, clearly showing your Kali Linux username14.

 Explanations: A concise, clear explanation below each screenshot15.

 Flags/Answers: All three discovered ingredients must be clearly highlighted (e.g.,

bold or boxed) in your document16.

CHAT GPT

Nice — I see the lab sheet you uploaded for the TryHackMe Pickle Rick room. I’ll give you a
clear, step-by-step procedure (with the exact commands to run and what to screenshot) so
you can finish the lab and produce the required report. Reminder: only run this against the
TryHackMe lab VM (authorized target).

Quick plan (what you’ll do)

1. Prepare Kali and create the required non-root account (screenshot).

2. Start the target VM from the TryHackMe room and obtain the IP.

3. Recon (nmap + web browsing). Check page source and hidden files/dirs (hints in the
lab).

4. Enumerate web content (gobuster/dirb), find credentials or files.

5. Use found creds to login (web or SSH). Capture user shell and user flag.

6. Local enumeration on the box (sudo, SUIDs, cron, configs).

7. Privilege escalation (misconfigured sudo/cron/SUID/etc.), capture root flag.

8. Prepare PDF report: screenshots, short explanations, highlight flags, file naming per
instructions.

Step-by-step with commands & what to screenshot

0) Read rules & confirm authorization

 The lab PDF reminds you to only attack the TryHackMe machine and to document
everything. Keep that in the front of your mind.

1) Create the required non-root Kali user (mandatory)

 In Kali (as root or default user), create your user and switch into it:
sudo adduser yourname

su - yourname

whoami

 Screenshot: terminal showing whoami output with your username (this proves you
used the required account). Explain in 1–2 lines that you created and used that
account (per ground rule).

2) Start the TryHackMe machine & note the IP

 From the TryHackMe website, deploy the Pickle Rick machine and copy its IP address.

 Screenshot: TryHackMe machine page showing the machine state / IP. Mention the
IP at top of your notes.

3) Initial network scan (nmap)

 Do a quick service scan to find open ports:

nmap -sC -sV -oN nmap_initial.txt <TARGET_IP>

 If you want a full port sweep first:

nmap -p- -T4 -oN nmap_full.txt <TARGET_IP>

# then target discovered ports with -sC -sV

 What to look for: open HTTP (80/8080), SSH (22), other services. Note service
versions.

 Screenshot: nmap output that shows the open ports you used for next steps.

4) Visit the web service and check page source

 Open the site in your browser: [Link]

 Check page source (View → Page Source) and any comments — hints often hide
here. The lab hint explicitly told you to check page source.

 Also grab a quick curl of the root page:

curl -s [Link] | sed -n '1,120p'

 Screenshot: browser with page open and page source showing any clue/comment
you found.

5) Enumerate hidden files / directories (web discovery)

 Use a directory brute force tool (gobuster is common):

gobuster dir -u [Link] -w /usr/share/wordlists/dirbuster/directory-list-2.3-
[Link] -t 40 -o [Link]

 Check for [Link], .git/, .env, backup files, or config files. Also try common
filenames like admin, login, secret, [Link].

curl -s [Link]

curl -s [Link]

 What to look for: credentials, API keys, or paths to other pages (the lab hints
specifically mention hidden files/directories).

 Screenshot: gobuster results or the files you found; briefly explain why they matter.

6) Inspect interesting files (look for credentials)

 If you find a config file, .env, or commented credentials in HTML, note the
username/password or tokens.

 Sometimes credentials are obfuscated (base64) — decode to reveal them:

echo 'BASE64STRING' | base64 -d

 Screenshot: the file showing credentials and a small note “found credentials: user:...,
pass:...”

7) Try the credentials (web or SSH)

 If web has a login, try the creds there. If port 22 open, try SSH:

ssh user@<TARGET_IP>

# enter password you found

 Screenshot: successful login prompt or a shell showing whoami and hostname.

8) On-box enumeration (once you have a shell)

 Basic commands:

id

uname -a

hostname

pwd

ls -la

 Automated enumeration (recommended): run a local enumeration script. If allowed,

download linpeas (or run small manual checks):
# example manual checks:

sudo -l # see sudo permissions

ps aux --sort=start_time | head -n 20 # running processes

find / -perm -4000 -type f 2>/dev/null # SUID files

ls -la /etc/cron.* /etc/crontab 2>/dev/null # cron

 Safety note: only fetch public scripts from trusted sources (TryHackMe commonly
allows linpeas for learning).

 Screenshot: outputs that led you to the privilege escalation path (e.g., sudo -l
showing allowed commands or a writable file shown by find).

9) Search for the user flag / “ingredient” #1 / #2

 Typical places:

ls -la /home

cat /home/<username>/[Link] # or similar

find / -name '*ingredient*' 2>/dev/null

 Screenshot: the file content with the ingredient/flag; in your report bold or box the
flag per the lab instructions.

10) Privilege escalation (find root access)

 Checklist to examine:

o sudo -l — any allowed commands as root? If yes, that’s often the escalation
path.

o SUID binaries (find / -perm -4000 -type f 2>/dev/null) — are any writable or
exploitable?

o Writable files owned by root in /etc or scripts run by root (cronjobs).

o Plaintext passwords in config files or service files.

o Scheduled tasks referencing writable scripts.

 If you find an exploitable sudo permission or writable root cron/script, use that to
spawn a root shell. (Use safe, standard techniques taught in class/CTF resources —
the lab hints said “Think about ways to gain higher privileges.”)

 Screenshot: evidence you used to escalate (e.g., sudo -l output or id showing uid=0).

11) Capture the root flag / final ingredient

  Once root:

cat /root/[Link] # or the named ingredient file

 Screenshot: root flag shown in terminal. Emphasize the flag in your report.

12) Produce the report PDF

Follow the ground rules from the lab:

 Use the naming format: YourName_RoomName_Lab#.pdf.

 For each screenshot include a short explanation (2–4 lines) — concise and in your
own words.

 Highlight flags (bold/box).

 Trim long outputs (you can snip scans but keep the lines that prove the path).

Suggested report structure

1. Title page (Name, Room, Date).

2. Lab objective (one paragraph).

3. Environment setup screenshots (your username proof).

4. Recon (nmap, ports discovered) — screenshot + 1-2 lines.

5. Web enumeration (page source, hidden files) — screenshot + 1-2 lines.

6. Exploitation (credentials found + how you used them) — screenshot + note.

7. On-box enumeration & escalation evidence — screenshots + notes.

8. Flags (clearly boxed/bold).

9. Conclusion & lessons learned.

Quick copy-paste command cheat-sheet (authorized lab only)

# create user (run once)

sudo adduser yourname

su - yourname

whoami

# nmap quick
nmap -sC -sV -oN nmap_initial.txt <TARGET_IP>

# gobuster (web dir brute)

gobuster dir -u [Link] -w /usr/share/wordlists/dirbuster/directory-list-2.3-

[Link] -t 40 -o [Link]

# quickly fetch root page

curl -s [Link] | sed -n '1,120p'

# try ssh (if creds found)

ssh user@<TARGET_IP>

# on-box quick checks

id; uname -a; whoami

sudo -l

find / -perm -4000 -type f 2>/dev/null

ls -la /etc/cron.* /etc/crontab 2>/dev/null

find / -type f -iname '*flag*' 2>/dev/null

# search for the ingredients (example)

find / -name '*ingredient*' -type f 2>/dev/null

Final notes / help I can give next

 I can convert this step-by-step into a report template (PDF) with the screenshots
placeholders and suggested text for each screenshot.

 If you want, paste the outputs or screenshots here and I’ll help you write the short
(concise) explanations to include in the report.

Want me to generate the report template (PDF) now, or do you want the template for
screenshots first?