xsspresso
xsspresso
WriteupsVHL — Tracker
WebMediumLinux

VHL — Tracker

MantisBT bug tracker on Debian with POP3. Credential enumeration via mail service and MantisBT RCE for shell access.

February 19, 2025Virtual Hacking Labs
#MantisBT#POP3#Dovecot#RCE

nmap

sh
nmap -sC -sV -T4 -A -Pn -p- --open 10.11.1.153
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-19 08:30 EST
Nmap scan report for 10.11.1.153
Host is up (0.024s latency).
Not shown: 65529 closed tcp ports (reset)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 f0:00:10:be:f0:65:61:dc:26:c1:18:1b:c3:74:eb:48 (RSA)
|   256 8f:d0:e0:45:e4:39:0c:36:07:ba:7c:80:52:47:80:c1 (ECDSA)
|_  256 24:46:78:31:ac:c4:26:d4:ff:de:9b:18:e0:de:26:97 (ED25519)
80/tcp  open  http     Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
| http-title: MantisBT
|_Requested resource was http://10.11.1.153/login_page.php
110/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: TOP SASL RESP-CODES CAPA STLS AUTH-RESP-CODE PIPELINING UIDL
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after:  2031-07-25T15:32:40
143/tcp open  imap     Dovecot imapd
|_imap-capabilities: capabilities Pre-login more ENABLE LOGIN-REFERRALS IDLE post-login STARTTLS have LOGINDISABLEDA0001 OK ID LITERAL+ IMAP4rev1 listed SASL-IR
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after:  2031-07-25T15:32:40
993/tcp open  ssl/imap Dovecot imapd
|_imap-capabilities: capabilities Pre-login more LOGIN-REFERRALS IDLE post-login LITERAL+ have SASL-IR OK ID ENABLE AUTH=PLAINA0001 listed IMAP4rev1
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after:  2031-07-25T15:32:40
|_ssl-date: TLS randomness does not represent time
995/tcp open  ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=tracker
| Subject Alternative Name: DNS:tracker
| Not valid before: 2021-07-27T15:32:40
|_Not valid after:  2031-07-25T15:32:40
|_pop3-capabilities: TOP SASL(PLAIN) RESP-CODES CAPA USER AUTH-RESP-CODE PIPELINING UIDL
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=2/19%OT=22%CT=1%CU=35386%PV=Y%DS=2%DC=I%G=Y%TM=67B5
OS:DD33%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=109%TI=Z%II=I%TS=A)SEQ(S
OS:P=103%GCD=1%ISR=109%TI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10A%TI=Z%II=I%TS
OS:=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M
OS:5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE
OS:88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=
OS:S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%
OS:O=%RD=0%Q=)T6(R=N)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPC
OS:K=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
 
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
TRACEROUTE
HOP RTT      ADDRESS
1   23.55 ms 10.11.1.153
 
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.24 seconds
 

80

sh
80/tcp  open  http     Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
| http-title: MantisBT
|_Requested resource was http://10.11.1.153/login_page.php