CyberTalents — Evil Rick writeup

The write-up explains the Evil Rick challenge, which involves an insecure Python Pickle deserialization vulnerability. The researcher found hardcoded credentials hidden in the login page’s HTML comments, logged in, and discovered a rememberme cookie containing Base64-encoded data. After decoding it, they identified the data as a Python Pickle object. Because the server deserialized the user-controlled cookie with pickle.loads() without proper validation, the researcher abused the __reduce__ method to achieve Remote Code Execution (RCE). Since command output was not returned directly in the HTTP response, they used a webhook to exfiltrate the contents of /etc/passwd. By replacing the rememberme cookie with a crafted Pickle payload and refreshing the page, the server deserialized the payload and executed the embedded command, confirming successful exploitation.