CCTV hosts a ZoneMinder surveillance install. I’ll exploit a blind SQL injection in ZoneMinder’s event handling to dump the user database, and crack a bcrypt hash to get a foothold over SSH. I’ll use tcpdump configured to let non-privileged users capture traffic to sniff and recover another user’s password leaking in the clear. That password unlocks a motionEye instance on localhost, where I’ll abuse an authenticated command injection in the still-image filename setting, working around client-side input validation, to execute code as root. In Beyond Root, I’ll show the unintended path that reaches root directly by talking to Motion’s unauthenticated control interface.

0xdf hacks stuff

A walkthrough of the HackTheBox machine CCTV, covering multiple exploitation steps. Starting with CVE-2024-51482, a blind SQL injection in ZoneMinder v1.37.63's event handling, sqlmap is used with boolean-based techniques to dump user credentials and crack bcrypt hashes for SSH access. From there, tcpdump (configured with cap_net_raw capability) is used to sniff cleartext credentials from a custom management protocol, gaining access as sa_mark. Finally, CVE-2025-60787, an authenticated command injection in motionEye v0.43.1b4's still-image filename setting, is exploited by bypassing client-side JavaScript validation to achieve remote code execution as root. A bonus section covers an unintended path using Motion's unauthenticated HTTP control interface directly to inject commands, and a quirk in motionEye's password hashing that allows login with the SHA1 hash instead of the plaintext password.

HTB: CCTV