📹Surveillance HTB Walkthrough

Welcome to the world of cybersecurity challenges! In this walkthrough, we'll delve into "Surveillance," a medium-level machine on HackTheBox.

Surveillance HTB Walkthrough

Reconnaissance

Scanning

First, I scan the network using nmap:

I find two open ports:

Website Enumeration

Subsequently, I append the following line to /etc/hosts:

Upon browsing the website, I see it's running CraftCMS 4.4.14.

Exploitation

Website Exploitation

I find an Remote Code Execution (RCE) vulnerability: Exploit-DB 51918arrow-up-right.

Privilege Escalation

Horizontal privilege escalation

First, I identify two users:

After digging further, I find a backup file containing an SQL query that adds a user named Matthew.

I crack the hash using crackstation.comarrow-up-right

connect with it to SSH

Now, let’s see what is zoneminder

ZoneMinder is an open-source video surveillance software suite that is designed to monitor, record, and manage multiple IP cameras, webcams, and other video sources. It is commonly used for security surveillance purposes in homes, businesses, and other environments where video monitoring is required.

I found that there is a website running locally on port 8080

Here is it

By using the zmc command, I was able to determine the version.

Further investigation uncovers a known exploit for RCE: CVE-2023-26035arrow-up-right related to zoneminder 1.36.32

  1. I use socat to make the website externally accessible:

  1. running the exploit

Vertical privilege escalation

Now, time to escalate privileges to root, I find that zoneminder has sudo access.

Digging deeper, I find that zmupdate.pl executes a mysql command based on user input without validation.

testing ….

It work, let's get a shell.

BOOM! We are ROOT

Last updated