HackTheBox - CCTV
Source: YouTube · IppSec · published Jul 11, 2026 · 1:07:56
This video demonstrates a walkthrough of the HackTheBox machine "CCTV," focusing on exploiting a ZoneMinder SQL injection and converting it from a slow time-based attack into a fast boolean-based injection 0:00.
Key Takeaways:
• Initial recon reveals SSH and HTTP (Apache) on an Ubuntu server, with a ZoneMinder web interface accessible using default credentials (admin/admin) 1:01 3:13.
• The ZoneMinder instance (v1.37.63) is vulnerable to CVE-65791, an SQL injection in the tid parameter; however, SQLmap defaults to slow, unreliable time-based techniques 10:01 14:50.
• By manually testing a UNION SELECT payload and identifying the correct number of columns, the injection is converted to boolean-based, allowing SQLmap to use the --technique=B flag with 10 threads for rapid data extraction 17:25 20:52.
• Dumping the database yields a bcrypt hash for user "mark," which is cracked to "opensesame," providing SSH access 23:08 30:00.
• Privilege escalation is achieved via a local MotionEye service using a command injection vulnerability in the image filename configuration, granting a root shell either through the web UI or an unauthenticated API on port 7999 36:35 44:00.
The presenter also highlights using Claude AI to analyze error logs and automatically derive the boolean-based SQL injection syntax, showcasing a modern approach to overcoming frustrating exploitation hurdles 1:00:00.
Sources:
- 0:00 Introduction to the CCTV box and the time-based SQL injection frustration
- 1:01 Nmap scan results showing SSH and HTTP open
- 3:13 Logging into ZoneMinder with default admin credentials
- 17:25 Manually discovering the UNION SELECT boolean injection
- 23:08 Extracting and formatting password hashes from the database dump
- 44:00 Achieving root via MotionEye's unauthenticated web control port API
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing CCTV from hack the box which is an easy box but the first step frustrated a lot of people because you have to do an SQL injection and by default SQL map use timebased techniques which is extremely slow and unreliable. However, the injection itself is pretty simple. For some reason, SQL map doesn't turn it into a booleanbased, but with a little bit of thinking, you can turn this uh blind SQL injection into a boolean based SQL injection, which makes it a much more enjoyable experience. Once we dump the database, we get a shell on the box through a reuse credential. And there's a few ways to private to the motion I server listing on local host. So, with all that being said, let's just jump in. As always, we're going to start with …