dreadnaught- Machine
- CCTV
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 7 Mar 2026
Default ZoneMinder creds plus a blind SQLi (CVE-2024-51482) leak a crackable hash; a root-run motionEye lets an authenticated config injection run as root.
How it went
- 0nmap
nmap shows SSH and an Apache site fronting ZoneMinder 1.37.63.
- 1ZoneMinder
ZoneMinder accepts the default admin:admin login.
- 2blind SQLi
A blind SQL injection in the removetag tid parameter (CVE-2024-51482) dumps the user bcrypt hashes.
- 3mark
mark's hash cracks from rockyou (opensesame), giving SSH access.
- 4motionEye RCE
motionEye on localhost runs as root; its config password signs an API call that injects a command into picture_filename, running as root.