CCTV Writeup (HackTheBox Easy Machine)
Created: 2026-07-12
Updated: 2026-07-18
Overview:
CCTV is an easy-rated HackTheBox machine that simulates attacking a video surveillance server.
It focuses on real vulnerabilities in CCTV management software, mainly ZoneMinder and motionEye.
Reconnaissance
Ran a quick naabu scan to enumerate ports then nmap :
Ports 22 and 80 are open. Added cctv.htb to /etc/hosts.
Here’s the first look : A dashboard to a security cameras’ service
Nothing stood out so I had to do some more enumeration with ffuf:
An interesting endpoint is revealed : zm for ZoneMinder, an open-source video surveillance management system.
FUN:
Successful login with default credentials admin:admin takes us to a dashboard that reveals ZM’s version : v1.37.63.
CVE-2024-51482
CVE-2024-51482 is a critical boolean-based SQL Injection vulnerability affecting ZoneMinder versions 1.37.* through 1.37.64. It allows authenticated attackers with low privileges to execute arbitrary SQL commands on the underlying database server.
Started first by dumping the available databases:
1 | sqlmap -u 'http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1' --cookie="ZMSESSID=7vst2i25ocuqqal39kll16gkje" --batch |
Then the tables from the zm database (omitted here), identified the Users table and dumped it
1 | sqlmap -u "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1" \ |
It contained usernames and hashed passwords
Here I just retry retrieving mark‘s password because it stopped :)
1 | sqlmap -u "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1" --cookie="ZMSESSID=0jg4me5q9rmc7fjg9cgtp6v3ar" -D zm -T Users -C "Username,Password" --where="Username='mark'" --dump --batch --threads=10 --hex --time-sec=2 |
Cracked it using Hashcat :
1 | hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt |
Password turns out to be : opensesame
SSH with mark’s credentials:
The user.txt file is nowhere to be found so I checked other paths and checking the internal services revealed some interesting stuff :
My first instinct, inspired by the last CVE, was to check mysql but that failed.
Port forwarding the service at 8765 reveals a motionEye login interface.
motionEye is an open-source web-based interface used to manage surveillance cameras. It acts as a frontend (control panel) for the motion detection software Motion.
After a little searching I could locate the admin creds at /etc/motioneye/motion.conf
@admin_username admin
@normal_username user
@admin_password 989c5a8ee87a0e9521ec81a79187d162109282f0
Version revealed successfully : motionEye 0.43.1b4
CVE-2025-60787
The open-source webcam security software, MotionEye, is vulnerable to remote code execution, in versions prior to and including 0.43.1b4. Authenticated users with access to the web UI may inject arbitrary shell meta-characters into the config fields; primarily the image_file_name config option under Still Images.
With a bit of digging I found out that the payload (revshell wrapped in $(..)) may fail because of server-side sanitization. Furthermore, the evaluation happens at motion level and not in motionEye . The former lies at port 7999. Port forwarded it and then simply automatized the whole process.
Successful Root access :
Rating
Fun machine , I’m not sure if the intended solve is Root then User, but still pretty enjoyable.
4 Stars.
⭐⭐⭐⭐
Please share with your friends !