Walkthrough of HackTheBox CCTV machine — from ZoneMinder default credentials and CVE-2024-51482 blind SQLi to root via motionEye’s HMAC-signed API command injection in on_event_start hooks