osTicket
PHP helpdesk system. The classic attack is sensitive-data exposure: register using a captured internal email domain to read tickets that contain credentials; ost-config.php holds DB creds.
Ports
| Port | Proto | Notes |
|---|---|---|
80 | tcp | HTTP |
443 | tcp | HTTPS |
Fingerprint
- osTicket footer and version on the support pages
- Staff control panel at /scp/login.php
Key files
| Path | Holds | Sensitive |
|---|---|---|
include/ost-config.php | DB credentials and the secret salt | sensitive |
Default / weak creds
staff/agent accounts via reuse or weak passwords
Known CVEs
| CVE | Impact |
|---|---|
| version CVEs | file upload, SSRF and stored XSS in older releases |
Exploitation primitives
- Sensitive data exposure: if you control an email on the org domain, open a ticket and read replies, internal tickets often leak credentials
- Account registration tied to a captured domain grants a portal session
- Attachment upload and known-version vulnerabilities
Overview
osTicket is a support-ticket app. Its standout weakness is process, not memory corruption: tickets carry conversations, and those conversations carry secrets you can reach by registering with the right email domain.
Enumeration
Find the staff panel and version:
curl -sI http://<TARGET>/scp/login.phpcurl -s http://<TARGET>/setup/doc/ -o /dev/null -w '%{http_code}\n' # leftover /setup hints at version/misconfigSensitive-data exposure (the classic path)
osTicket’s standout weakness is process, not memory. If you control an inbox on the org’s email domain, the ticket system leaks internal conversations:
- From recon, get a valid org email domain (and an address you can receive mail for — sometimes the box is the mail server).
- Open a ticket / register from that address, then read staff replies and internal notes — they routinely contain credentials.
- Watch for an auto-generated ticket ID + email combo, which is the portal login.
Check the client portal for the reply:
curl -s "http://<TARGET>/view.php?id=<TICKET_ID>" -b "OSTSESSID=<cookie>"Loot the config
Any file read (LFI, traversal, or a shell) gives DB creds + the secret salt:
curl -s http://<TARGET>/include/ost-config.phpOlder releases (≤ 1.14/1.15) carry attachment-upload, SSRF and stored-XSS CVEs — fingerprint the version first and check it against the advisories before assuming the email path.
Hardening
Restrict self-registration, scope ticket visibility, patch promptly, and keep ost-config.php unreadable.