CCTV

Hack The Box · app.hackthebox.com/machines/CCTV · retired

Linux Easy creds / auth-bypass ● Completed

TL;DR A case study in credential hygiene: a surveillance dashboard left on default admin credentials, a second account's password sitting in plaintext shell history, and a locally-running service that could be tricked into trusting a forged authentication signature. Three preventable misses chained into root — no zero-day required.

01Recon

nmap -sC -sV -oN nmap/cctv 10.10.11.XX
# web front-end for a surveillance/CCTV management app
gobuster dir -u http://10.10.11.XX -w /usr/share/wordlists/dirb/common.txt

02Foothold — default credentials

The CCTV management dashboard was still running on out-of-the-box default admin credentials. Logging in gave an authenticated foothold into the application and access to functionality that exposed the underlying host.

user.txt<redacted>

03Lateral — password in shell history

With a foothold, basic post-exploitation enumeration paid off: a second account's password was sitting in plaintext in shell history. Always read the history files.

cat ~/.bash_history /home/*/.bash_history 2>/dev/null
cat ~/.zsh_history 2>/dev/null
# credential for the next account, reused for su / SSH

04Privilege Escalation — forged auth signature

Root came from a locally-running service that validated authentication using a signature it could be tricked into trusting. By forging a valid-looking signature, the service accepted the request and executed it in a privileged context — an access-control / trust-boundary flaw rather than a memory bug.

root.txt<redacted>

05Defensive takeaways

Change default credentials on every appliance and dashboard — this was the whole front door.
Keep secrets out of shell history — pass credentials via prompts or env, and clear history for service accounts.
Least privilege on local services, and never trust a client-supplied signature without verifying it against a secret the client can't reach.
The "boring" controls — unique creds, clean history, least privilege — are the ones that get skipped and then exploited first.

back to writeups