Rce on Rio Blog

HTB - CCTV Write-Up

Sun, 31 May 2026 16:48:47 -0400

Summary

CCTV is a Linux HackTheBox machine exposing SSH and a ZoneMinder web application on HTTP. The key foothold is an authenticated SQL injection in ZoneMinder 1.37.63, specifically the removetag action affected by CVE-2024-51482. After authenticating to the panel, the SQLi can be exploited with sqlmap to dump zm.Users, recover password hashes, and crack the mark account password.

Once on the box as mark, privilege escalation comes from a second service: motionEye. A world-readable /etc/motioneye/motion.conf exposes the motionEye admin credential hash. That hash is sufficient to compute valid request signatures for the localhost-only motionEye API on 127.0.0.1:8765. By updating camera configuration and setting command_storage_exec, it is possible to trigger root command execution through the snapshot action.

HTB - WingData Write-Up

Sun, 31 May 2026 14:22:01 -0400

Summary

WingData is a Linux machine built around Wing FTP Server. The intended path chains a Wing FTP unauthenticated RCE into credential recovery for SSH access as wacky, followed by a root escalation through a Python tarfile extraction bug exposed by a sudo-allowed restore script.

Attack chain:

Wing FTP exposure → config leakage / credential recovery → SSH as wacky → vulnerable tar restore script → root

Step	Technique	Result
Recon	`nmap`, vhost checks, `ffuf`	Wing FTP attack surface identified
Initial access	Wing FTP RCE / recovered credentials	SSH as `wacky`
Privilege escalation	CVE-2025-4517 (`tarfile.extractall(filter="data")`)	`root`

Target

HTB - SmartHire Write-Up

Sat, 30 May 2026 14:00:00 +0700

Summary

SmartHire is a medium-difficulty Linux machine from HackTheBox. It hosts an AI hiring platform built with Flask on nginx, using MLflow for model management. Initial access is gained via CVE-2024-37054, a pickle deserialization vulnerability in MLflow that allows remote code execution by overwriting a model artifact with a malicious payload. Privilege escalation exploits a writable plugin directory combined with a sudo rule — a crafted .pth file executed by site.addsitedir() runs as root.