HTB — CCTV (Easy Linux)

Overview

CCTV is an Easy-difficulty Linux machine featuring ZoneMinder surveillance software exploitation and MotionEye privilege escalation. This machine teaches:

• CCTV/surveillance system security
• SQL injection in specialized applications
• Password hash cracking
• SSH key-based authentication
• MotionEye RCE exploitation
• Service-based privilege escalation

Enumeration

Port Scanning

Standard web and SSH ports are exposed.

Key Services:

• SSH (22/tcp)
• HTTP (80/tcp) - ZoneMinder application

Web Application

The target hosts ZoneMinder 1.37.63, an open-source video surveillance software management system.

Initial Foothold

CVE Chain Overview

CVE-2024-51482 (SQL Injection)
    ↓
Database Credential Extraction
    ↓
Bcrypt Hash Cracking
    ↓
SSH Access

SQL Injection in ZoneMinder

ZoneMinder 1.37.63 contains an authenticated SQL injection vulnerability that can be exploited to extract sensitive information.

Exploitation Path:

1. Identify vulnerable parameter
2. Exploit SQL injection to dump database
3. Extract user credentials (bcrypt hashes)
4. Crack password hashes
5. SSH access with recovered credentials

Privilege Escalation

MotionEye Discovery

Once on the system, discover:

• MotionEye service running as root
• Version vulnerable to CVE-2025-60787
• Web interface accessible on localhost

RCE via MotionEye

The privilege escalation involves:

1. Port forwarding to access local MotionEye instance
2. Exploiting CVE-2025-60787 for command injection
3. Executing commands as root via vulnerable service
4. Gaining root shell access

Key Concepts

• Understanding surveillance software architecture
• SQL injection exploitation techniques
• Bcrypt hash cracking strategies
• Port forwarding for internal service access
• Command injection in configuration interfaces

Root Flag Location: /root/root.txt

Key Takeaways

• Specialized applications often have unique vulnerabilities
• SQL injection remains a critical threat
• Bcrypt provides strong password protection but isn't unbreakable
• Internal services running as root are high-value targets
• Configuration interfaces need input validation

Tools Used

• nmap - Port scanning
• gobuster - Web enumeration
• sqlmap - SQL injection automation
• john / hashcat - Password cracking
• ssh - Remote access
• chisel - Port forwarding
• Custom exploit scripts