ostVersionScanner.py

#!/usr/bin/python3

################################################################
#
# This script determines the exact version of osTicket being
# used either by looking in the /setup/ directory, or by
# inspecting publicly-available CSS and JS files. See the
# section "Version Number" in the README.md for more
# information.
# 
# This scanner was designed by comparing differences in
# publicly-available CSS and JS files, which means that custom
# installations of the osTicket software may not be accurate.
# 
# Note - this was tested on multiple osTicket installations,
# including versions 1.10.1, 1.12, 1.14.4, 1.15.3, and 1.16.3
# (https://github.com/osTicket/osTicket/releases)
# 
# Example: python3 ostVersionScanner.py https://my.domain.com
# 
# If the osTicket installation is not at the root directory /,
# but is in a folder (such as /osTicket/) instead, put the base
# of the URL for the domain. For example,
# https://my.domain.com/osTicket/.
# 
################################################################


### IMPORTS ###
import requests, sys, random
from bs4 import BeautifulSoup



### ARGUMENT PARSING ###
if len(sys.argv) != 2:
    print("Usage: python3 ostVersionScanner.py http://doma.in/")
    quit()
domain = sys.argv[1]

if domain[-1] != "/":
    domain += "/"



### DEFINE FUNCTIONS FOR CODE CLARIFY ###
def get_page(method, URL, headers={}, data=""):
    try:
        result = requests.request(method, URL, headers=headers, data=data)
    except Exception as e:
        print("[-] Error making request")
        print(e)
        quit()
    return result



### CHECK /SETUP/ DIRECTORY ###
result = get_page("GET", domain+"setup/")

if result.status_code == 200:
    html = BeautifulSoup(result.text, "html.parser")
    try:
        version = html.find_all("div", {"class":"info"})[0].text[20:]
        print("[+] osTicket version found in /setup/ directory")
        print("[+] Version:",version)
        exit()
    except SystemExit:
        # it doesn't like exit() or quit() inside of try statements, so this my awful hacky workaround
        quit()
    except:
        "Probably custom installation since this is where installation version should be located"



### CHECK CSS AND JS FILES ###
print("[-] /setup/ directory not found, checking CSS and JS files...")


## versions 1.16.3 or 1.15.8
result = get_page("GET", domain+"css/ui-lightness/jquery-ui-1.13.1.custom.min.css")

if result.status_code == 200:
    print("[+] Version(s): 1.16.3 or 1.15.8")
    quit()
else:
    "404 should be returned since this file didn't exist in previous versions"
    "https://github.com/osTicket/osTicket/compare/v1.16.2...v1.16.3#diff-9e1bac9a1f462a2a5b509c02efdf3c64079d101179d626f44e8be7f77e69a71e"


## versions 1.16.2 or 1.15.7
result = get_page("GET", domain+"css/flags.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 35 and len(lines[35]) == 47:
        print("[+] Version(s): 1.16.2 or 1.15.7")
        quit()
    "All versions under this should have 50 characters in the line. The background-position property for .flag.flag-bs was changed from -208px to 0px"
    "https://github.com/osTicket/osTicket/compare/v1.16.1...v1.16.2#diff-b31fb5228eb91778855fb40ebf9e9975bfcf71b85d96939faeb4e7a883a0978c"


## versions 1.15.5 to 1.15.7, or 1.16 to 1.16.2
if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 124 and len(lines[124]) >= 39 and lines[124][37:39] == "64":
        print("[+] Version(s): 1.15.5 to 1.15.7, or 1.16 to 1.16.2")
        quit()
    "The background-position property for .flag.flag-km was changed from -96px to -64px"
    "https://github.com/osTicket/osTicket/compare/v1.15.4...v1.15.5#diff-b31fb5228eb91778855fb40ebf9e9975bfcf71b85d96939faeb4e7a883a0978c"


## versions 1.15.4 and 1.14.8
URL = domain+"pwreset.php"
headers = {}
headers["Content-Type"] = "application/x-www-form-urlencoded"

# get CSRF token and cookie
result = get_page("GET", domain+"pwreset.php")
html = BeautifulSoup(result.text, "html.parser")
CSRF_TOKEN = html.find_all("input", {"name":"__CSRFToken__"})[0]["value"]
headers["Cookie"] = result.headers['Set-Cookie'].split(";")[0]

# send random data as email to reset password and extract response data
payload = f"__CSRFToken__={CSRF_TOKEN}&do=sendmail&userid={'%07x' % random.randrange(16**7)}"
result = get_page("POST", URL, headers, payload)

if "If the information provided is valid a password" in result.text:
    # more checks can be made to distinguish between 1.15.4 and 1.14.8
    result = get_page("GET", domain+"scp/css/scp.css")
    
    if result.status_code == 200:
        lines = result.text.split("\n")
        if len(lines) > 420 and "}" in lines[420]:
            print("[+] Version(s): 1.15.4")
            quit()
        else:
            print("[+] Version(s): 1.14.8")
            quit()
else:
    "The password reset feature in older versions does not contain a generic message, but rather tells the user if the email address is invalid"
    "https://github.com/osTicket/osTicket/compare/v1.15.3...v1.15.4#diff-b2dbc2711843b2d165ada08ba6eada76e026943937ce7ccee62bc147e5b0cbe7"


## versions 1.15.3 and 1.14.7
result = get_page("GET", domain+"css/redactor.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 366 and ".redactor-overlay" in lines[366]:
        result = get_page("GET", domain+"scp/css/scp.css")
        if result.status_code == 200:
            css_lines = result.text.split("\n")
            if len(css_lines) > 420 and "}" in css_lines[420]:
                print("[+] Version(s): 1.15.3.1 or 1.15.3")
                quit()
            else:
                print("[+] Version(s): 1.14.7")
                quit()
    "Versions right before have #redactor-overlay on line 367, and even earlier versions have other lines"
    "https://github.com/osTicket/osTicket/compare/v1.14.6...v1.14.7#diff-bc65180fe10d9210d0ebf5b23d233c10d675e7b038b0381b9f45e9e5b9c64ab2"


## version 1.15.2
result = get_page("GET", domain+"scp/css/scp.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 421 and "}" in lines[420] and ".customQ-dropdown a.truncate" in lines[421]:
        print("[+] Version(s): 1.15.2")
        quit()
    "Previous versions have 'text-transform:capitalize;' on the line 421 instead"
    "https://github.com/osTicket/osTicket/compare/v1.15.1...v1.15.2#diff-40ef161d6f625cf348617c6a6b566f5b7a35d821201b748d01ad26b3991c5128"


## version 1.14.6
result = get_page("GET", domain+"js/redactor-plugins.js")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 475 and "var $head = $R.dom(current).closest('thead');" in lines[475]:
        print("[+] Version(s): 1.14.6")
        quit()
    "This line was added in version 1.14.6, earlier versions had '$component.removeRow(current);' instead"
    "https://github.com/osTicket/osTicket/compare/v1.14.5...v1.14.6#diff-d9f8fbb84e58579c18ca20f900f9eb38a9d298f75e40480e8c5611de098290b7"


## versions 1.15.1 or 1.14.5
result = get_page("GET", domain+"css/redactor.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 1075 and "margin-left: 1.5em" in lines[1075]:
        print("[+] Version(s): 1.15.1 or 1.14.5")
        quit()
    "This line was changed in version 1.14.5, earlier versions had 'margin: 0 1.5em 0 0;' instead"
    "https://github.com/osTicket/osTicket/compare/v1.14.4...v1.14.5#diff-bc65180fe10d9210d0ebf5b23d233c10d675e7b038b0381b9f45e9e5b9c64ab2"


## versions 1.15 or 1.14.4
if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 340 and "1051" in lines[340]:
        print("[+] Version(s): 1.15 or 1.14.4")
        quit()
    "The value for z-index on line 341 of /css/redactor.css was changed to 1051 from 1050 in versions 1.15 and 1.14.4"
    "https://github.com/osTicket/osTicket/compare/v1.14.3...v1.14.4#diff-bc65180fe10d9210d0ebf5b23d233c10d675e7b038b0381b9f45e9e5b9c64ab2"


## version 1.14.3
result = get_page("GET", domain+"js/redactor-plugins.js")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 251 and "," in lines[251]:
        print("[+] Version(s): 1.14.3")
        quit()
    "The comma was removed from this line between versions 1.14.2 and 1.14.3"
    "https://github.com/osTicket/osTicket/compare/v1.14.2...v1.14.3#diff-d9f8fbb84e58579c18ca20f900f9eb38a9d298f75e40480e8c5611de098290b7"


## versions 1.14.2 or 1.12.6
result = get_page("GET", domain+"css/osticket.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 92:
        # more checks can be done to distinguish between 1.14.2 and 1.12.6
        result = get_page("GET", domain+"css/redactor-font.eot")

        if result.status_code == 200:
            print("[+] Version(s): 1.14.2")
            quit()
        else:
            print("[+] Version(s): 1.12.6")
            quit()
        
        "This file didn't exist in previous versions"
        "https://github.com/osTicket/osTicket/compare/v1.12.6...v1.14.2#diff-bf3e1cc415cb1674da655f2e7707211c159f09d0809c518b211d7eba9e122f8e"
    "Previous versions only had 87 lines in /css/osticket.css"
    "https://github.com/osTicket/osTicket/compare/v1.14.1...v1.14.2#diff-93db74c6d57d3e80cce63d3b756d6475e0296515cda08a03254df8cf7d337243"


## versions 1.14.1 or 1.14
result = get_page("GET", domain+"css/filedrop.css")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 71 and ".-redactor-container + .filedrop .dropzone," in lines[71]:
        print("[+] Version(s): 1.14.1 or 1.14")
        quit()
    "Line 72 was changed in filedrop.css in version 1.14"
    "https://github.com/osTicket/osTicket/compare/v1.12.5...v1.14#diff-986519d232c0e1529dc7d6d334de4816b0564694cfcd580ad4c2145f83260667"


## versions 1.12.4 or 1.12.5
result = get_page("GET", domain+"scp/js/scp.js")

if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 715 and "$('a[href^=\"#'+div.attr('id')+'\"]').parent().addClass('error');" in lines[715]:
        print("[+] Version(s): 1.12.4 or 1.12.5")
        quit()
    "Double quotes were added to line 716 in version 1.12.4"
    "https://github.com/osTicket/osTicket/compare/v1.12.3...v1.12.4#diff-b0b53030b29d6d3611a41b8ec0b684d60819b4f62f65ceda37b8db76adedcd85"


## version 1.12.3
if result.status_code == 200:
    lines = result.text.split("\n")
    if len(lines) > 267 and "dateFormat: c.date_format || 'm/d/Y'" in lines[267]:
        print("[+] Version(s): 1.12.3")
        quit()
    "The 'translate_format' function was removed in version 1.12.3"
    "https://github.com/osTicket/osTicket/compare/v1.12.2...v1.12.3#diff-b0b53030b29d6d3611a41b8ec0b684d60819b4f62f65ceda37b8db76adedcd85"


## version 1.12.2
result = get_page("GET", domain+"images/favicon.png")

if result.status_code == 200:
    print("[+] Version(s): 1.12.2")
    quit()
else:
    "This file was created in version 1.12.2"
    "https://github.com/osTicket/osTicket/compare/v1.12.1...v1.12.2#diff-37b561214b36d454f9fd1f725d77f310fe256eb88f2a0ae08b9cb18aeb30650c"


## version 1.12.1
result = get_page("GET", domain+"css/jquery-ui-timepicker-addon.css")

if result.status_code == 200:
    print("[+] Version(s): 1.12.1")
    quit()
else:
    "This file was created in version 1.12.1"
    "https://github.com/osTicket/osTicket/compare/v1.12...v1.12.1#diff-0653b4d2662061ca410d8ef73d8658608c19aaf70bc4ebaa1d5faa60ab2735f4"


## version 1.12 or 1.11
result = get_page("GET", domain+"images/oscar-favicon-16x16.png")

if result.status_code == 200:
    # more checks can be done to distinguish between 1.12 and 1.11
    result = get_page("GET", domain+"scp/js/ticket.js")

    if result.status_code == 200:
        lines = result.text.split("\n")
        if len(lines) > 309 and "timeout: 30000" in lines[309]:
            print("[+] Version(s): 1.12")
            quit()
        else:
            print("[+] Version(s): 1.11")
            quit()

    "'timeout: 30000' was added to ticket.js in version 1.12"
    "https://github.com/osTicket/osTicket/compare/v1.11...v1.12#diff-ee53e971138db5c8a1bfc16b926a2c03fcd77ce559c42221ea360bb01b3347ba"
else:
    "This file was created in versions 1.12 and 1.11"
    "https://github.com/osTicket/osTicket/compare/v1.10.7...v1.12#diff-b3d18fc8d2a7fc0d54af736b66985a22af717146017cf7faf49d494a3bd2a5b2"


# more checks can be added here, but since version 1.11 was released in 2019 (3 years before making this) and there are several vulnerabilities past that point, I figured this was sufficient


# else
print("[+] Version(s): < 1.11")