Post cover image

August 25, 2026

Silent Monitor TryHackMe Writeup | From SQL Injection to Root Access

Hello everyone 👋, in this write-up we’ll tackle the junior pentesting challenge “Silent Monitor.” This is a very interesting challenge. In…

By A. AntorCSE404

6 min read

Hello everyone 👋, in this write-up we'll tackle the junior pentesting challenge "Silent Monitor." This is a very interesting challenge. In this whole write-up I will try to put the concept in your brain. Let's get started…

Room link: Silent Monitor.

None

To solve this challenge, I will use the TryHackMe attack box. In your case, you can use Attackbox or your own Kali machine (you must have to be connected by OpenVPN). Lab IP is given. Let's start scanning with nmap…

root@ip-10-49-74-67:~# nmap -sS -sV -T4 -p- 10.49.138.6

Output:
      Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-08-24 16:20 UTC
      Nmap scan report for ip-10-49-138-6.ap-south-1.compute.internal (10.49.138.6)
      Host is up (0.00015s latency).
      Not shown: 65533 closed tcp ports (reset)
      PORT     STATE SERVICE VERSION
      22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
      5050/tcp open  http    Werkzeug httpd 2.0.2 (Python 3.10.12)
      Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

      Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
      Nmap done: 1 IP address (1 host up) scanned in 8.92 seconds

From the scanning outcome, we see that two ports are open. One is port 22, and another is port 5050. Now navigate to port 5050.

None

After navigating, we see that a Flask-based web app is given. But nothing is interesting in here. We do not know how many directories there are in the web app. Now we have to try to find out the directories of this web app. For that, we will use Gobuster.

root@ip-10-49-74-67:~# gobuster dir -u http://10.49.138.6:5050 -w /usr/share/wordlists/dirb/common.txt

Output:
      ===============================================================
      Gobuster v3.6
      by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
      ===============================================================
      [+] Url:                     http://10.49.138.6:5050
      [+] Method:                  GET
      [+] Threads:                 10
      [+] Wordlist:                /usr/share/wordlists/dirb/common.txt
      [+] Negative Status codes:   404
      [+] User Agent:              gobuster/3.6
      [+] Timeout:                 10s
      ===============================================================
      Starting gobuster in directory enumeration mode
      ===============================================================
      /internal             (Status: 200) [Size: 8770]
      Progress: 4614 / 4615 (99.98%)
      ===============================================================
      Finished
      ===============================================================
      root@ip-10-49-74-67:~#

We get a directory named "internal." Now navigate this directory.

None

Finally, we get a login page. For login we do not know any username and password. Now we will check whether these fields have SQL injection vulnerabilities. We will use the payload in given below:

' OR 1=1 -- -
None

Then press the Authenticate button.

Wow, the SQL injection payload has worked. Now, we are inside the dashboard. In the dashboard Host Health section, I have found a field where we can run a ping command, just providing the IP address. Now, we will check if it has a Command Execution vulnerability??

None

But this is not working by the payload ";".

None

Let's try another way.

None

It is also not working. But if we try the %0A (newline) payload, what will happen?

None

So, it confirms the common execution vulnerabilities. Now we will try to read secret files.

None

But we failed. Let's try another way. Inspect the page.

None

Then go to the network.

None

Then press Reload the page.

None

Then press Resend.

None

Then click Edit and Resend.

None None

Now, we will check the files by using the ls -la command.

None

In here we see a file named "secret.config." Now, we will try to read it by using the cat command.

None

In here, "secret.config," a credential, has been found. Now let's try to use this credential.

None

Finally, by using credentials, we are in sysadmin.

sysadmin@tryhackme-2204:~$ ls
backups  user.txt
sysadmin@tryhackme-2204:~$ cat user.txt
THM{*****_*nd_***_1nj3ct10n_***_y0u_*****}
sysadmin@tryhackme-2204:~$ whoami
sysadmin
sysadmin@tryhackme-2204:~$

We get our first flag inside the user.txt. Submit it and earn points. I also checked sysadmin to see whether it was root or not. But it confirmed that sysadmin is not root. Now our task is for the low-previlleged sysadmin user to get the root access.

None

We also check the backups directory to retrieve something interesting. In here we get a file name infrastructure.kdbx.

What is the ".kdbx" file? A .kdbx file is an encrypted database format used primarily by KeePass and its compatible offshoots (like KeePassXC and KeeWeb) to store sensitive login credentials, secure notes, and encryption keys.

Now at first we have to transfer the file from the sysadmin user to our local machine. To do this I will use SCP (Secure Copy Protocol). Exit from the sysadmin user.

None

Now, infrastructure.kdbx is in our local machine. Now, what will we do? Our task is Convert the database file into a format readable by password cracking suites using keepass2john:

[ keepass2john is a tool/script from John the Ripper used to extract a password hash from a KeePass database file. You generally cannot give a .kdbx file directly to John the Ripper. First, you extract its crackable hash]

None

We get the hash password of the infrastructure.kdbx file. With the hash extracted, perform an offline dictionary attack using a standard wordlist like "rockyou.txt."

None

At this phase, we get the master password of the "infrastructure.kdbx." The master password for the KeePass vault is successfully revealed as "spring."

Unlocking the Vault: Instead of spinning up a graphical interface, inspect the database securely from your command-line workspace using keepassxc-cli.

[ keepassxc-cli is the command-line interface for KeePassXC, used to interact with KeePass password database files (.kdbx) directly from the terminal. It allows you to list groups and entries, search for stored credentials, view specific entries, and manage the database without opening the KeePassXC graphical application. In a TryHackMe scenario, if you have a file such as infrastructure.kdbx, you can use keepassxc-cli to inspect the database after obtaining its master password.]

None

This output reveals a highly specific, protected entry: "Root User Password—Sensitive." Now we have to extract the plaintext password specifically from that attribute.

None

Output reveals the raw target password. Now, we can shift from the sysadmin user to root privileges by using this password. Connect again by using SSH like previously. Then run this command given below and retrieve the root flag.

sysadmin@tryhackme-2204:~$ su root
Password:
root@tryhackme-2204:/home/sysadmin#

root@tryhackme-2204:/home/sysadmin# ls
backups  user.txt

root@tryhackme-2204:/home/sysadmin# cat /root/flag.txt
cat: /root/flag.txt: No such file or directory

root@tryhackme-2204:/home/sysadmin# cat /root/root.txt
THM{****_*****_H4s_****_*******_****}

root@tryhackme-2204:/home/sysadmin#

Finally, we have finished our challenge for this room. Thank you so much for reading the walkthrough patiently.

If you enjoyed this write-up, consider following me (A. AntorCSE404) for more write-ups and CTF challenges, and feel free to leave feedback—I'd love to learn and improve!