Post cover image

October 20, 2026

The Case: Seven Minutes on the Seine (THM) Tryhackme Walkthrough

The Case: Seven Minutes on the Seine

By Lawvye

3 min read

None

The Case: Seven Minutes on the Seine

Description : You are the analyst on call after a hi-vis crew struck the Galerie d'Apollon and fled toward the river. Investigate using only open sources.

Difficulty : Easy

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/thecasesevenminutesontheseine

Enjoy.

Walkthrough :

Task 1: Seine Incident

In this task, you are presented with a quiz page containing 5 questions regarding the theft of the French crown jewels at the Louvre Museum, which occurred on October 19, 2025.

While you can look up the answers manually using OSINT techniques (such as tracking data from the Louvre's online collection catalog and official INTERPOL wanted posters), there is a quick web exploitation method to bypass this quiz form validation directly:

  1. OSINT Path (If You Wish to Answer Manually):
  • Question 1 (Entrance Gate): Search for information regarding the river-side entrance gate parked near the fire brigade stairs.
  • Question 2 (Relic Brooch): Search the Louvre's online collection catalog for Empress Eugénie's Reliquary Brooch. The data is: Inventory number: MV 1024, Maker: Bapst, Acquisition: assigned, 1887, Current location: not exposed.
  • Question 3 (INTERPOL Reference ID): Look up the 2025 Louvre art theft case documents on INTERPOL. The case prefix is 2025/359. The specific item numbers are 2025/359.1 (Sapphire Diadem) and 2025/359.5 (Reliquary Brooch).
  • Question 4 (Ceiling Painting): The central painting in the Galerie d'Apollon is Apollon vainqueur (Inventory: INV 3818).
  1. Web Exploitation Shortcut (Get the Flag Directly):
  • Open your browser's developer tools (right-click -> View Page Source or press F12 and check the Network tab).
  • Inspect the source code or the API paths called by the web application.
  • You will find an API endpoint named /api/success-message.
  • Access this endpoint directly through your browser or use a cURL command:
curl http://<THM_MACHINE_IP>/api/success-message
  • The page will immediately return the Task 1 flag without requiring you to fill out the quiz manually.

Task 2: Louvre Protocol

In this second part, you are required to log into the Louvre's CCTV monitoring system, which suffers from weak default security credentials.

  1. Bypassing the Login Panel:
  • After starting the Task 2 machine and navigating to the provided IP address, you will see the CCTV system login page.
  • Based on OSINT clues regarding a leaked internal museum security audit found on the internet, the default credentials used are straightforward and entirely in lowercase:
  • Username: louvre
  • Password: louvre
  • Enter these credentials to access the main Louvre Security Monitoring dashboard.
  1. Finding the Second Flag:
  • Inside the dashboard, you will see several camera feed panels. Checking the source code at this stage will not instantly reveal the flag.
  • The key is to filter the old video footage based on the date the break-in incident occurred.
  • Change the calendar/date filter on the dashboard to the date of the theft: 19–10–2025 (October 19, 2025).
  • Changing this filter to the incident date will trigger an alert state in the system and display the CCTV footage containing the Task 2 Flag on your screen.

Task 1 Seine Incident

Something audacious unfolded beneath the glass pyramid.

In the early hours, a crew in hi-vis vests breached the Galerie d'Apollon inside the Louvre. Security feeds went dark, and seven minutes later, the team disappeared toward the river.

You are the first analyst on call. Your mission is to reconstruct the details of the heist using open-source intelligence and online reports. The museum is under pressure, international alerts are spreading, and the press is already digging for answers.

Gather and verify information from public sources: museum pages, heritage archives, news coverage, social media, and open databases.

Click the Start Lab Machine button and access the portal via this link to get started. Note that the machine may take 2–3 minutes to initialise.

Answer the questions below

Q1.) What is the value of the flag?

Answer : THM{n1c3_h31st_r3s34rch}

Task 2 Louvre Protocol

A recent news report referencing an earlier audit of the museum's surveillance network revealed serious weaknesses: outdated servers, inconsistent camera coverage, and a weak password policy. As the on-call CCTV analyst, your job is to verify whether the credential clues in those reports are valid against the system and then use them to review the footage from the day of the incident, documenting every step and source.

You may refer to online sources to identify the correct credential pair for this lab environment and review the footage from the day of the incident.

Click the Start Lab Machine button and access the portal via this link to get started. Note that the machine may take 2–3 minutes to initialise.

Answer the questions below

Q1.) What is the value of the flag?

Answer : THM{cctv_4ud1ts_4r3_fun}

None None

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye