Surveillance
Surveillance
Surveillance 580
Surveillance
RETIRED MACHINE

Surveillance

Surveillance - Linux Linux
Surveillance - Medium Medium

4.4

MACHINE RATING

6951

USER OWNS

5667

SYSTEM OWNS

09/12/2023

RELEASED
Created by TheCyberGeek & TRX

Machine Synopsis

Surveillance is a medium-difficulty Linux machine that showcases a vulnerability (`[CVE-2023-41892](https://nvd.nist.gov/vuln/detail/CVE-2023-41892)`) in Craft CMS, which abuses PHP object injection to inject PHP content into the Craft CMS web log files to gain Remote Code Execution (RCE). The privilege escalation abuses ZoneMinder with an authenticated remote code injection in the `HostController.php` API endpoint to gain a shell as the `zoneminder` user. As this user, a `sudo` entry is abused by adding a configuration environment variable `LD_PRELOAD` via the admin panel and loading the malicious library file through `zmdc.dl` on the target, compromising the system.

Machine Matrix

Ready to start your
hacking journey?