CCTV HTB
CCTV Welcome to my first Hack The Box walkthrough. In this write-up, I will demonstrate how I compromised the CCTV machine on Hack The Box. Hack The Box is a great platform for learning and improving penetration testing skills, covering everything from initial reconnaissance to exploitation and reporting. If you are new here, feel free to follow along for more cybersecurity content and future write-ups. About the Machine CCTV is an easy Linux machine on Hack The Box that focuses on web exploitation, SQL injection, and privilege escalation. The attack starts by exploring a CCTV monitoring website, which leads to a ZoneMinder interface. Using default credentials, we gain access to the dashboard. A known vulnerability (CVE-2024-51482) allows SQL injection, which helps us extract user credentials from the database. After cracking the password, we log in via SSH as a valid user and get initial access to the system. During enumeration, we discover another service called motionEye running with higher privileges. By accessing it through SSH port forwarding and using exposed credentials, we log into its web interface. A command injection vulnerability (CVE-2025-60787) is then exploited to execute commands on the system. This leads to a reverse shell as root, giving full control over the machine. Finally, we retrieve both user and root flags, completing the challenge. Nmap Scan Setting Up Host Mapping Before starting enumeration, I added the target hostname to my /etc/hosts file: This allows my system to resolve cctv.htb to the target IP. Many Hack The Box machines use virtual hosts, so accessing the application with the correct hostname is important for it to work properly. Exploring the Web Interface With port 80 identified as open, I moved to the next step and accessed the web service through my browser using the target IP address. The page redirected to http://cctv.htb/ , confirming virtual host routing. Thanks to the /etc/hosts entry, the domain resolved without issues. image The landing page revealed a SecureVision CCTV website offering surveillance services. A “Staff Login” option hinted at an internal admin panel. While enumerating further, I explored additional paths and discovered a directory linked to a surveillance management platform. I then accessed the following endpoint: I searched for default credentials and found admin:admin from a ZoneMinder forum thread, which worked for authentication. Creds : admin : admin After logging in, I identified the ZoneMinder version as v1.37.63 Looking for exploits I searched for known vulnerabilities in ZoneMinder v1.37.63 and found CVE-2024-51482, a Boolean/time-based blind SQL injection in the web interface. ℹ️Source : https://www.cvedetails.com/cve/CVE-2024-51482/ Method 1 ( Using SqlMap ) While navigating to Options > Users, I noticed multiple users but didn’t have their passwords. To proceed, I grabbed the session cookie from the browser storage: ZMSESSID=9e6sgumc3chijd595v581346fb The ZMSESSID cookie represents the authenticated session. Since the vulnerable endpoint requires a valid session, I included this cookie in my requests. Without it, the server would block the request before reaching the vulnerable query. I passed the cookie to sqlmap using the --cookie option, allowing it to perform SQL injection as an authenticated user. I used sqlmap to exploit the SQL injection in the tid parameter and dump user credentials from the database: image Since the injection was blind and time-based, I forced the T technique with a 2-second delay. The ZMSESSID cookie was added to keep the requests authenticated. sqlmap identified MySQL as the backend and resumed the injection point automatically. The extraction was slow and produced several HTTP 500 errors, which is expected with time-based attacks, but the data was successfully retrieved. ⚠️ Warning: This will take about 5 to 10 minutes to complete. Method 2 (using github exploit) Dumping the users Database: Hashes : | username | Hash | |----------|----------| | superadmin | $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm | | mark | $2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG. | | admin | $2y$10$t5z8uIT.n9uCdHCNidcLf.39T1Ui9nrlCkdXrzJMnJgkTiAvRUM6m | Let's Crack the Hashses Just quick google search reavled that they are bcrypt hashes let's crack hashes using john Inital Access Logging in as the mark user Our machine : download latest linpeas from : https://github.com/peass-ng/PEASS-ng/releases/tag/20260417-9e62276b On my machine, I downloaded the latest version of linpeas from the official repository. To transfer it to the target machine, I started a simple HTTP server: Then, from the target machine, I downloaded the script from my host, as shown in the server logs: This successfully transferred linpeas to the target for further enumeration. Running Linpeas Target Machine: Adding permissions to linpeas.sh After running linpeas, I didn’t find anything interesting. So, I proceeded with manual enumeration. Service Enumeration let's Find services running on box : This one looks something related to our box let's deep dive it The service configuration showed that motionEye was running as root, making it a high-value target for privilege escalation. let's check the motioneye.conf Contents of motion.conf we got the adminin_password for motioneye : 989c5a8ee87a0e9521ec81a79187d162109282f0 Additionally, a motionEye service is running locally on:\ Port 7999 — Control API\ Port 8765 — Web Interface Internal Pivoting Pivoting to motionEye using Port Forwarding While reviewing the motionEye configuration, I observed that the web interface was restricted to localhost (webcontrol_localhost enabled), making it inaccessible externally. Since the service was bound to the local interface, I used SSH port forwarding to expose it and access it from my machine. This command forwards my local port 8765 to 127.0.0.1:8765 on the target. Since the service was bound to localhost, this tunnel exposed it externally over SSH. After logging in as mark, the tunnel was established successfully. Now, any request sent to: Requests from my machine were now transparently forwarded to the motionEye interface, allowing me to interact with the service as if I were on the target. With access to the internal UI, I began analyzing it for misconfigurations or vulnerabilities, especially since it was running as root Accessing the MotionEye web interface Logging with creds we already got from the motion.conf file username : admin \ password : 989c5a8ee87a0e9521ec81a79187d162109282f0 Successfully logged in : image We got the motion eye camera version motionEye Version | 0.43.1b4 \ Motion Version | 4.7.1 Exploitation After identifying the motionEye version (0.43.1b4), I searched for public exploits and found CVE-2025-60787, a command injection vulnerability. Exploit source: https://github.com/gunzf0x/CVE-2025-60787.git I cloned the repository: Next, I started a listener to capture the reverse shell: Then I executed the exploit The exploit authenticated successfully, injected the payload, and triggered a reverse shell. Upon execution, I received a shell as the root user, confirming full system compromise. Got the shell let's retrive the Flags : | User| Flag| Path |----------|----------|------------| | User | d193ab9f442d71d95* | /home/sa_mark/user.txt | Root | **1a4e8e321d1733574f82 | /root/root.txt Final Notes This machine was a great example of chaining multiple vulnerabilities to achieve full system compromise. Initial access was gained through a web application using default credentials. A time-based SQL injection vulnerability allowed extraction of user credentials. Weak password practices enabled successful password cracking. Internal service enumeration revealed motionEye running as root. SSH port forwarding was used to access a localhost-restricted service. Finally, a command injection vulnerability led to full root access. Overall, this box highlights the importance of: Securing web applications against SQL injection Avoiding default and weak credentials Properly restricting and securing internal services Even small misconfigurations, when combined, can lead to complete system compromise. ```