WriteupsVHL — Tracker
WebMediumLinux
VHL — Tracker
MantisBT bug tracker on Debian with POP3. Credential enumeration via mail service and MantisBT RCE for shell access.
February 19, 2025Virtual Hacking Labs
#MantisBT#POP3#Dovecot#RCE
nmap
sh
nmap -sC -sV -T4 -A -Pn -p- --open 10.11.1.153
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-19 08:30 EST
Nmap scan report for 10.11.1.153
Host is up (0.024s latency).
Not shown: 65529 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 f0:00:10:be:f0:65:61:dc:26:c1:18:1b:c3:74:eb:48 (RSA)
| 256 8f:d0:e0:45:e4:39:0c:36:07:ba:7c:80:52:47:80:c1 (ECDSA)
|_ 256 24:46:78:31:ac:c4:26:d4:ff:de:9b:18:e0:de:26:97 (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
| http-title: MantisBT
|_Requested resource was http://10.11.1.153/login_page.php
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: TOP SASL RESP-CODES CAPA STLS AUTH-RESP-CODE PIPELINING UIDL
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after: 2031-07-25T15:32:40
143/tcp open imap Dovecot imapd
|_imap-capabilities: capabilities Pre-login more ENABLE LOGIN-REFERRALS IDLE post-login STARTTLS have LOGINDISABLEDA0001 OK ID LITERAL+ IMAP4rev1 listed SASL-IR
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after: 2031-07-25T15:32:40
993/tcp open ssl/imap Dovecot imapd
|_imap-capabilities: capabilities Pre-login more LOGIN-REFERRALS IDLE post-login LITERAL+ have SASL-IR OK ID ENABLE AUTH=PLAINA0001 listed IMAP4rev1
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after: 2031-07-25T15:32:40
|_ssl-date: TLS randomness does not represent time
995/tcp open ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after: 2031-07-25T15:32:40
|_pop3-capabilities: TOP SASL(PLAIN) RESP-CODES CAPA USER AUTH-RESP-CODE PIPELINING UIDL
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=2/19%OT=22%CT=1%CU=35386%PV=Y%DS=2%DC=I%G=Y%TM=67B5
OS:DD33%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=109%TI=Z%II=I%TS=A)SEQ(S
OS:P=103%GCD=1%ISR=109%TI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10A%TI=Z%II=I%TS
OS:=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M
OS:5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE
OS:88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=
OS:S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%
OS:O=%RD=0%Q=)T6(R=N)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPC
OS:K=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 23.55 ms 10.11.1.153
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.24 seconds
80
sh
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
| http-title: MantisBT
|_Requested resource was http://10.11.1.153/login_page.phpUp next
HardFeb 2025
HTB — Checker
TeamCity authentication bypass combined with Bookstack SSRF to read internal files and chain into remote code execution.
Read writeup
MediumMar 2025
HTB — Cypher
Neo4j Cypher injection bypasses authentication. APOC procedure abuse executes OS commands for initial access and privesc.
Read writeup
EasyMar 2025
HTB — Dog
Backdrop CMS with exposed .git repository leaks DB credentials. Password reuse for SSH. SUID bee binary grants root.
Read writeup