CCTV — HTB Writeup | The Hack Sparrow

Executive summary — CCTV is an Easy Linux box with a surveillance theme (Ubuntu 24.04, kernel 6.8). The site runs ZoneMinder with default credentials (admin:admin); a time-based blind SQL injection (CVE-2024-51482) in the tid parameter dumps the Users table, including mark's bcrypt hash, which we crack with John and reuse over SSH. Once in, a world-readable config file leaks the SHA1 of motionEye's admin password —which doubles as its API signing key, so cracking it is unnecessary—, letting us forge authenticated requests and exploit CVE-2025-60787 (command injection in the motion binary, which runs as root) to run arbitrary commands. Path: ZoneMinder -> SQLi -> mark -> motionEye -> root.

Platform	Hack The Box
Operating system	Linux (Ubuntu 24.04, kernel 6.8)
Difficulty	Easy
Status	Retired
Target IP	`10.129.244.156`

Attack map

[80] ZoneMinder (/zm) -> default credentials admin:admin
   |  SQLi CVE-2024-51482 (tid param) -> dump of the Users table
   v
[hash] mark bcrypt -> john/rockyou -> opensesame
   v
[SSH] mark  (user.txt lives in /home/sa_mark, not /home/mark)
   |  motion.conf leaks admin's SHA1 -> valid signature for motionEye's API
   |  CVE-2025-60787: command injection in motion (root) via image_file_name
   v
[ROOT] root.txt

1. Reconnaissance

The box blocks ICMP (no ping) and the attacking environment has no sudo: /etc/hosts can't be edited and nmap -sS is off the table. The vhost is resolved on the fly with curl --resolve or the Host: header, and ports are scanned with nmap -sT (TCP connect, unprivileged) or straight with bash's /dev/tcp.

nmap -sT -p- --min-rate 2000 10.129.244.156
bash -c 'echo > /dev/tcp/10.129.244.156/80' && echo "80 OPEN"
bash -c 'echo > /dev/tcp/10.129.244.156/22' && echo "22 OPEN"

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.58
|_http-title: Did not follow redirect to http://cctv.htb/

Port 80 redirects to cctv.htb: a corporate landing page, "SecureVision CCTV & Security Solutions", linking to /zm.

curl -s -I http://10.129.244.156/
curl -s --resolve cctv.htb:80:10.129.244.156 http://cctv.htb/ | grep -oiE 'href="[^"]*"'
# -> href="http://cctv.htb/zm"

/zm/ serves a ZoneMinder login, the surveillance system that gives the box its name:

curl -s --resolve cctv.htb:80:10.129.244.156 http://cctv.htb/zm/ | grep -i '<title>'
# <title>ZM - Login</title>

Resumen ejecutivo — CCTV es un Linux Easy con tematica de videovigilancia (Ubuntu 24.04, kernel 6.8). La web monta ZoneMinder con credenciales por defecto (admin:admin); una inyeccion SQL ciega basada en tiempo (CVE-2024-51482) en el parametro tid permite volcar la tabla Users, incluido el hash bcrypt de mark, que crackeamos con John y reutilizamos por SSH. Ya dentro, un fichero de configuracion legible por todos filtra el SHA1 de la contraseña de admin de motionEye —que sirve como clave de firma de su API, sin necesidad de crackearlo—, lo que permite forjar peticiones autenticadas y explotar CVE-2025-60787 (command injection en el binario motion, que corre como root) para ejecutar comandos arbitrarios. Recorrido ZoneMinder -> SQLi -> mark -> motionEye -> root.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu 24.04, kernel 6.8)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.244.156`

Mapa del ataque

[80] ZoneMinder (/zm) -> credenciales por defecto admin:admin
   |  SQLi CVE-2024-51482 (param tid) -> dump de la tabla Users
   v
[hash] bcrypt de mark -> john/rockyou -> opensesame
   v
[SSH] mark  (user.txt en /home/sa_mark, no en /home/mark)
   |  motion.conf filtra el SHA1 de admin -> firma valida para la API de motionEye
   |  CVE-2025-60787: command injection en motion (root) via image_file_name
   v
[ROOT] root.txt

1. Reconocimiento

La maquina bloquea ICMP (no responde a ping) y en el entorno de ataque no hay sudo: no se puede editar /etc/hosts ni lanzar nmap -sS. Se resuelve el vhost al vuelo con curl --resolve o la cabecera Host:, y se escanean puertos con nmap -sT (TCP connect, no requiere privilegios) o directamente con /dev/tcp de bash.

nmap -sT -p- --min-rate 2000 10.129.244.156
bash -c 'echo > /dev/tcp/10.129.244.156/80' && echo "80 OPEN"
bash -c 'echo > /dev/tcp/10.129.244.156/22' && echo "22 OPEN"

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.58
|_http-title: Did not follow redirect to http://cctv.htb/

El puerto 80 redirige a cctv.htb: una landing corporativa "SecureVision CCTV & Security Solutions" con un enlace a /zm.

curl -s -I http://10.129.244.156/
curl -s --resolve cctv.htb:80:10.129.244.156 http://cctv.htb/ | grep -oiE 'href="[^"]*"'
# -> href="http://cctv.htb/zm"

En /zm/ aparece el login de ZoneMinder, el sistema de videovigilancia que da nombre a la maquina:

curl -s --resolve cctv.htb:80:10.129.244.156 http://cctv.htb/zm/ | grep -i '<title>'
# <title>ZM - Login</title>

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.