Web on Hackpuntes

CCTV WriteUp

Sat, 11 Jul 2026 00:00:00 +0000

CCTV is a 🟩 Easy machine on Hack The Box. It chains a SQL Injection in ZoneMinder to obtain SSH credentials, with the discovery of internal video surveillance services after pivoting from the compromised machine. Escalation to root is achieved through an authenticated RCE in motionEye.

IP: 10.129.3.35
Approximate time: ~1.5h

🗺️ Attack Chain

Nmap → Port 80 (ZoneMinder 1.37.63)
│
▼
Default credentials admin:admin → panel access
│
▼
CVE-2024-51482 (Boolean SQLi) → sqlmap → mark:opensesame
│
▼
SSH as mark
│
▼
LinPEAS → tcpdump (cap_net_raw) + internal ports
│
▼
Port Forwarding → motionEye 0.43.1b4 on :8765
│
▼
/etc/motioneye/motion.conf → admin:989c5a8ee87a0e9521ec81a79187d162109282f0
│
▼
CVE-2025-60787 (Metasploit RCE) → root 🏴

🔍 Reconnaissance

Port Scanning

echo "10.129.3.35 cctv.htb" | sudo tee -a /etc/hosts
sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv cctv.htb
grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv cctv.htb

Port	Service	Detail
`22`	SSH	OpenSSH 9.6p1 Ubuntu
`80`	HTTP	Apache 2.4.58 → `SecureVision CCTV`

Small attack surface. Port 22 is not vulnerable, so we focus on port 80.

Fridagate - Android Tool to Manage Frida and Intercept Traffic with Burp Suite

Wed, 15 Apr 2026 00:00:00 +0000

Fridagate is an open source Android application designed for mobile application pentesters. It allows you to manage frida-server, intercept HTTPS traffic with Burp Suite, and inject bypass scripts directly from the device — without having to run commands manually at the start of every audit session.

The project was born out of a real need: during an Android app audit the usual workflow involves connecting via ADB, pushing frida-server, setting permissions, starting it, configuring the system proxy, adding iptables rules… Fridagate automates all of that from a clean interface on the phone itself.

PortSwigger Labs - Exploiting LLM APIs with Excessive Agency

Mon, 09 Mar 2026 00:00:00 +0000

You’re auditing a web application that uses a Large Language Model (LLM) as a customer support assistant. On the surface it looks harmless — user asks, model answers. But underneath that chat interface something far more dangerous is hiding: the LLM has direct access to a debug API that runs arbitrary SQL commands against the production database.

That’s exactly the scenario behind the “Exploiting LLM APIs with Excessive Agency” lab from PortSwigger Web Security Academy.