The vulnerability allowed an attacker to achieve remote code execution on vulnerable versions. The exploit leverages the path traversal vulnerability CVE-2018-14847 to extract the admin password and create an 'option' package to enable the developer backdoor. Post exploitation the attacker can connect to Telnet or SSH using the root user 'devel' with the admin's password.

For more information on this vulnerability you can read the advisory Ī working PoC for this vulnerability can be found in, contains the compilation and usage instructions.Īt that time, my then ISP was impacted by this particular vulnerability and bingo, I was able to obtain admin credentials. RADIUS server and secret key RADIUS Server and Secret Key Post Exploitation - Packet Sniffing We can now successfully authenticate to the Mikrotik router.Īnd now we can obtain information such as, SSID & WiFi passwords.

Now think about this, imagine if we could be in a position to obtain every traffic going through the gateway, couldn't it be amazing, no need of ARP spoofing for we are listening capturing all traffic going through the router. Yeah using this hypothesis, I was able to discover an inbuilt packet sniffer integrated in Mikrotik, worked fine except for one disadvantage, the router's memory is not big enough so it has got size limitation on the size of the pcap file. On further research, I noticed that one could do remote packet streaming, to a remote host running wireshark.

Mikrotik packet sniffer wireshark