CCTV
01Recon
nmap -sC -sV -oN nmap/cctv 10.10.11.XX
# web front-end for a surveillance/CCTV management app
gobuster dir -u http://10.10.11.XX -w /usr/share/wordlists/dirb/common.txt02Foothold — default credentials
The CCTV management dashboard was still running on out-of-the-box default admin credentials. Logging in gave an authenticated foothold into the application and access to functionality that exposed the underlying host.
03Lateral — password in shell history
With a foothold, basic post-exploitation enumeration paid off: a second account's password was sitting in plaintext in shell history. Always read the history files.
cat ~/.bash_history /home/*/.bash_history 2>/dev/null
cat ~/.zsh_history 2>/dev/null
# credential for the next account, reused for su / SSH04Privilege Escalation — forged auth signature
Root came from a locally-running service that validated authentication using a signature it could be tricked into trusting. By forging a valid-looking signature, the service accepted the request and executed it in a privileged context — an access-control / trust-boundary flaw rather than a memory bug.
05Defensive takeaways
- Change default credentials on every appliance and dashboard — this was the whole front door.
- Keep secrets out of shell history — pass credentials via prompts or env, and clear history for service accounts.
- Least privilege on local services, and never trust a client-supplied signature without verifying it against a secret the client can't reach.
- The "boring" controls — unique creds, clean history, least privilege — are the ones that get skipped and then exploited first.
◆If this were my environment
No advanced exploit was needed: default credentials, plaintext history and a weak signature boundary supplied the whole path. I would start with identity hygiene and make the privileged service independently verify every request.
- Force a unique password at first boot, disable vendor defaults, require MFA for administration and restrict the dashboard to a management network.
- Keep secrets out of command lines and shell history; inject short-lived credentials from a secrets manager and rotate anything exposed.
- Use a standard authenticated protocol with replay protection and server-side key custody instead of a client-provided or forgeable signature.
- Run the local service without root where possible, expose only a narrow socket/API and record every privileged action.
Hardening guides and benchmarks
These references offer different implementation paths: consensus benchmarks, prescriptive government checklists, vendor baselines and application-security verification requirements. I would select the profile that matches the system's role, document exceptions, test it in staging and continuously measure drift.