Module: Msf::Auxiliary::Mikrotik

Includes:

Report

Defined in:

lib/msf/core/auxiliary/mikrotik.rb

Overview

This module provides methods for working with Mikrotik equipment

Instance Method Summary

• #export_to_hash(config) ⇒ Object

  this handles ‘export` (default), `export compact`, `export terse` and `export verbose` the format is a header line: `/ tree navigation` followed by commands: `set thing value`.

• #mikrotik_routeros_config_eater(thost, tport, config) ⇒ Object
• #mikrotik_swos_config_eater(thost, tport, config) ⇒ Object
• #values_to_hash(line) ⇒ Object

  this takes a string of config like ‘add connect-to=10.99.99.99 name=l2tp-hm password=123 user=l2tp-hm’ and converts it to a hash of keys and values for easier processing.

Methods included from Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Metasploit::Framework::Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines

Instance Method Details

#export_to_hash(config) ⇒ Object

this handles ‘export` (default), `export compact`, `export terse` and `export verbose` the format is a header line: `/ tree navigation` followed by commands: `set thing value`

# File 'lib/msf/core/auxiliary/mikrotik.rb', line 15

def export_to_hash(config)
  return {} unless config.is_a? String

  config = config.gsub(/^\s{2,4}/, '') # replace code indents
  config = config.gsub(/\\\s*\n/, '') # replace verbose multiline items as single lines, similar to terse
  output = {}
  header = ''
  config.each_line do |line|
    line = line.strip
    # # jul/16/2020 14:26:57 by RouterOS 6.45.9
    # typically the first line in the config
    if %r{^# \w{3}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} by (?<os>\w+) (?<version>[\d\.]+)$} =~ line
      output['OS'] = ["#{os} #{version}"]

    # terse format format is more 'cisco'-ish where header and setting is on one line
    # /interface ovpn-client add connect-to=10.99.99.98 mac-address=FE:45:B0:31:4A:34 name=ovpn-out1 password=password user=user
    # /interface ovpn-client add connect-to=10.99.99.98 mac-address=FE:45:B0:31:4A:34 name=ovpn-out2 password=password user=user
    elsif %r{^(?<section>/[\w -]+)} =~ line && (line.include?(' add ') || line.include?(' set '))
      [' add ', ' set '].each do |div|
        next unless line.include?(div)

        line = line.split(div)
        if output[line[0].strip]
          output[line[0].strip] << "#{div}#{line[1]}".strip
          next
        end
        output[line[0].strip] = ["#{div}#{line[1]}".strip]
      end

    # /interface ovpn-client
    # these are the section headers
    elsif %r{^(?<section>/[\w -]+)$} =~ line
      header = section.strip
      output[header] = [] # initialize

    # take any line that isn't commented out
    elsif !line.starts_with?('#') && !header.empty?
      output[header] << line.strip
    end
  end
  output
end

#mikrotik_routeros_config_eater(thost, tport, config) ⇒ Object

# File 'lib/msf/core/auxiliary/mikrotik.rb', line 175

def mikrotik_routeros_config_eater(thost, tport, config)
  if framework.db.active
    credential_data = {
      address: thost,
      port: tport,
      protocol: 'tcp',
      workspace_id: myworkspace_id,
      origin_type: :service,
      private_type: :password,
      service_name: '',
      module_fullname: fullname,
      status: Metasploit::Model::Login::Status::UNTRIED
    }
  end

  # Default SNMP to UDP
  if tport == 161
    credential_data[:protocol] = 'udp'
  end

  store_loot('mikrotik.config', 'text/plain', thost, config.strip, 'config.txt', 'MikroTik Configuration')

  host_info = {
    host: thost,
    os_name: 'Mikrotik'
  }
  report_host(host_info)

  if config.is_a? String
    config = export_to_hash(config)
  end
  config.each do |header, values|
    case header
      #
      # Cover OS details
      #
    when 'OS'
      values.each do |value|
        print_good("#{thost}:#{tport} OS: #{value}")
        v = value.split(' ')
        host_info[:os_name] = v[0]
        host_info[:os_flavor] = v[1]
        report_host(host_info)
      end

      #
      # OpenVPN client details
      #
    when '/interface ovpn-client'
      # https://wiki.mikrotik.com/wiki/Manual:Interface/OVPN#Client_Config
      # add connect-to=10.99.99.98 mac-address=FE:45:B0:31:4A:34 name=ovpn-out1 password=password user=user
      # add connect-to=10.99.99.98 disabled=yes mac-address=FE:45:B0:31:4A:34 name=ovpn-out3 password=password user=user
      # no such thing as disabled=no, the value is just not there
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] ? 'disabled' : ''} Open VPN Client to #{value['connect-to']} on mac #{value['mac-address']} named #{value['name']} with username #{value['user']} and password #{value['password']}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:port] = 1194
        cred[:service_name] = 'openvpn'
        cred[:username] = value['user']
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end

      #
      # PPPoE client details
      #
    when '/interface pppoe-client'
      # https://wiki.mikrotik.com/wiki/Manual:Interface/PPPoE#PPPoE_Client
      # add disabled=no interface=ether2 name=pppoe-user password=password service-name=internet user=user
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] ? '' : 'disabled'} PPPoE Client on #{value['interface']} named #{value['name']} and service name #{value['service-name']} with username #{value['user']} and password #{value['password']}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:username] = value['user']
        cred[:service_name] = 'pppoe'
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end

      #
      # L2TP client details
      #
    when '/interface l2tp-client'
      # https://wiki.mikrotik.com/wiki/Manual:Interface/L2TP#L2TP_Client
      # add connect-to=10.99.99.99 name=l2tp-hm password=123 user=l2tp-hm
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] ? '' : 'disabled'} L2TP Client to #{value['connect-to']} named #{value['name']} with username #{value['user']} and password #{value['password']}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:port] = 1701
        cred[:service_name] = 'l2tp'
        cred[:username] = value['user']
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end
      #
      # PPTP client details
      #
    when '/interface pptp-client'
      # https://wiki.mikrotik.com/wiki/Manual:Interface/PPTP#PPTP_Client
      # add connect-to=10.99.99.99 disabled=no name=pptp-hm password=123 user=pptp-hm
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] ? '' : 'disabled'} PPTP Client to #{value['connect-to']} named #{value['name']} with username #{value['user']} and password #{value['password']}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:service_name] = 'pptp'
        cred[:port] = 1723
        cred[:username] = value['user']
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end
      #
      # SNMP details
      #
    when '/snmp community'
      # https://wiki.mikrotik.com/wiki/Manual:SNMP
      # add addresses=::/0 authentication-password=write name=write write-access=yes
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        if value['encryption-password'] # v3
          print_good("#{thost}:#{tport} SNMP community #{value['name']} with password #{value['authentication-password']}(#{value['authentication-protocol']}), encryption password #{value['encryption-password']}(#{value['encryption-protocol']}) and #{value['write-access'] ? 'write access' : 'read only'}")
        else
          print_good("#{thost}:#{tport} SNMP community #{value['name']} with password #{value['authentication-password']} and #{value['write-access'] ? 'write access' : 'read only'}")
        end

        next unless framework.db.active

        cred = credential_data.dup
        if value['write-access'] == 'yes'
          cred[:access_level] = 'RW'
        else
          cred[:access_level] = 'RO'
        end
        cred[:protocol] = 'udp'
        cred[:port] = 161
        cred[:service_name] = 'snmp'
        cred[:private_data] = value['name']
        create_credential_and_login(cred)
      end
      #
      # PPP tunnel bridging secret details
      #
    when '/ppp secret'
      # https://wiki.mikrotik.com/wiki/Manual:BCP_bridging_(PPP_tunnel_bridging)#Office_1_configuration
      # add name=ppp1 password=password profile=ppp_bridge
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] ? 'disabled' : ''} PPP tunnel bridging named #{value['name']} with profile name #{value['profile']} and password #{value['password']}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:username] = ''
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end
      #
      # SMB users details
      #
    when '/ip smb users'
      # https://wiki.mikrotik.com/wiki/Manual:IP/SMB#User_setup
      # add name=mtuser password=mtpasswd read-only=no
      # add disabled=yes name=disableduser password=disabledpasswd
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} #{value['disabled'] == 'yes' ? 'disabled' : ''} SMB Username #{value['name']} and password #{value['password']}#{' with RO only access' if value['read-only'] == 'yes' || !value['read-only']}")
        next unless framework.db.active

        cred = credential_data.dup
        if value['read-only'] == 'yes' || !value['read-only']
          cred[:access_level] = 'RO'
        end
        cred[:service_name] = 'smb'
        cred[:username] = value['name']
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end
      #
      # SMTP user details
      #
    when '/tool e-mail'
      # https://wiki.mikrotik.com/wiki/Manual:Tools/email#Properties
      # set address=1.1.1.1 from=router@router.com password=smtppassword user=smtpuser
      values.each do |value|
        next unless value.starts_with?('set ')

        value = values_to_hash(value)
        print_good("#{thost}:#{tport} SMTP Username #{value['user']} and password #{value['password']} for #{value['address']}:#{value['port'] || '25'}")
        next unless framework.db.active

        cred = credential_data.dup
        cred[:service_name] = 'smtp'
        cred[:port] = value['port'] ? value['port'].to_i : 25
        cred[:address] = value['address']
        cred[:protocol] = 'tcp'
        cred[:username] = value['user']
        cred[:private_data] = value['password']
        create_credential_and_login(cred)
      end
      #
      # Wireless networks details
      #
    when '/interface wireless security-profiles'
      # https://wiki.mikrotik.com/wiki/Manual:Interface/Wireless#Security_Profiles
      # add name=openwifi supplicant-identity=MikroTik
      # add authentication-types=wpa-psk mode=dynamic-keys name=wpawifi supplicant-identity=MikroTik wpa-pre-shared-key=presharedkey
      # add authentication-types=wpa2-psk mode=dynamic-keys name=wpa2wifi supplicant-identity=MikroTik wpa2-pre-shared-key=presharedkey
      # add authentication-types=wpa2-eap mode=dynamic-keys mschapv2-password=password mschapv2-username=username name=wpaeapwifi supplicant-identity=MikroTik
      # add mode=static-keys-required name=wepwifi static-key-0=0123456789 static-key-1=0987654321 static-key-2=1234509876 static-key-3=0192837645 supplicant-identity=MikroTik
      values.each do |value|
        next unless value.starts_with?('add ')

        value = values_to_hash(value)
        output = "#{thost}:#{tport} Wireless AP #{value['name']}"

        if !value['authentication-types'] && (!value['mode'] || value['mode'] == 'none') # open wifi
          output << ' with no encryption (open wifi)'
          vprint_good(output)
          next
        end

        if framework.db.active
          cred = credential_data.dup
        else
          cred = {}
        end

        # The following section is a little complicated due to the way mikrotik exports values
        # in compact/terse/default mode, it will skip printing default values, so we have to check
        # that keys are present.
        # In verbose mode, they will print but be empty
        if value['wpa-pre-shared-key'] && !value['wpa-pre-shared-key'].empty?
          output << " with WPA password #{value['wpa-pre-shared-key']}"
          if framework.db.active
            cred[:private_data] = value['wpa-pre-shared-key']
            create_credential_and_login(cred)
          end
        elsif value['wpa2-pre-shared-key'] && !value['wpa2-pre-shared-key'].empty?
          output << " with WPA2 password #{value['wpa2-pre-shared-key']}"
          if framework.db.active
            cred[:private_data] = value['wpa2-pre-shared-key']
            create_credential_and_login(cred)
          end
        elsif value['authentication-types'] == 'wpa2-eap'
          output << " with WPA2-EAP username #{value['mschapv2-username']} password #{value['mschapv2-password']}"
          if framework.db.active
            cred[:username] = value['mschapv2-username']
            cred[:private_data] = value['mschapv2-password']
            create_credential_and_login(cred)
          end
        elsif value['static-key-0'] || value['static-key-1'] || value['static-key-2'] || value['static-key-3']
          (0..3).each do |i|
            key = "static-key-#{i}"
            next unless value[key]

            output << " with WEP password #{value[key]}"
            if framework.db.active
              cred[:private_data] = value[key]
              create_credential_and_login(cred) # run for each key we find
            end
          end
        end

        print_good(output)
      end

      #
      # hostname details
      #
    when '/system identity'
      # https://wiki.mikrotik.com/wiki/Manual:System/identity#Configuration
      # set name=mikrotik_hostname
      values.each do |value|
        next unless value.starts_with?('set ')

        value = values_to_hash(value)
        host_info[:name] = value['name']
        report_host(host_info)
      end
    end
  end
end

#mikrotik_swos_config_eater(thost, tport, config) ⇒ Object

# File 'lib/msf/core/auxiliary/mikrotik.rb', line 80

def mikrotik_swos_config_eater(thost, tport, config)
  if framework.db.active
    credential_data = {
      address: thost,
      port: tport,
      protocol: 'tcp',
      workspace_id: myworkspace_id,
      origin_type: :service,
      private_type: :password,
      service_name: '',
      module_fullname: fullname,
      status: Metasploit::Model::Login::Status::UNTRIED
    }
  end

  # Default SNMP to UDP
  if tport == 161
    credential_data[:protocol] = 'udp'
  end

  store_loot('mikrotik.config', 'text/plain', thost, config.strip, 'config.txt', 'MikroTik Configuration')

  host_info = {
    host: thost,
    os_name: 'SwOS'
  }
  report_host(host_info)

  # Unfortunately SWoS doesn't have a very easily parsable format.  Config is exported in one big string
  # they follow a key:value format followed by a comma, but since values can be arrays,
  # or hashes the actual parsing of such would be pretty difficult.  Since there isn't a ton of value
  # in this file, we simply run some regexes against it

  # ,sys.b:{id:'4d696b726f54696b2d637373333236',wdt:0x01,dsc:0x01,ivl:0x00,alla:0x00,allm:0x00,allp:0x03ffffff,avln:0x00,prio:0x8000,cost:0x00,igmp:0x00,ip:0x0158a8c0,iptp:0x02,dtrp:0x03ffffff,ainf:0x01}
  # part we care about: ,ip:0x0158a8c0
  if /,ip:0x(?<ip>[\da-f]+)/ =~ config
    ip = ip.scan(/../).map { |x| x.hex.to_i }.reverse.join('.')
    print_status("#{thost}:#{tport} IP Address: #{ip}")
  end

  # ,sys.b:{id:'4d696b726f54696b2d637373333236'
  if /,sys.b:{id:'(?<host>[a-f\d]*)'/ =~ config
    host = Array(host).pack('H*')
    host_info[:name] = host
    report_host(host_info)
    print_good("#{thost}:#{tport} Hostname: #{host}")
  end

  # pull the switch password .pwd.b:{pwd:'61646d696e'} -> admin
  # pull the switch password .pwd.b:{pwd:''} -> (blank, which is default)
  if /,\.pwd\.b:{pwd:'(?<password>[a-f\d]*)'}/ =~ config
    password = Array(password).pack('H*')
    print_good("#{thost}:#{tport} Admin login password: #{password}")
    if framework.db.active
      cred = credential_data.dup
      cred[:port] = 80
      cred[:protocol] = 'tcp'
      cred[:service_name] = 'www'
      cred[:username] = 'admin' # hardcoded
      cred[:private_data] = password.to_s
      create_credential_and_login(cred)
    end
  end

  # ,snmp.b:{en:0x01,com:'7075626c6963',ci:'636f6e74616374696e666f',loc:'6c6f636174696f6e'}
  # ,snmp.b:{en:0x01,com:'7075626c6963',ci:'',loc:''}
  if /,snmp\.b:{en:0x01,com:'(?<community>[a-f\d]*)',ci:'(?<contact>[a-f\d]*)',loc:'(?<location>[a-f\d]*)'}/ =~ config
    community = Array(community).pack('H*')
    contact = Array(contact).pack('H*')
    location = Array(location).pack('H*')
    print_good("#{thost}:#{tport} SNMP Community: #{community}, contact: #{contact}, location: #{location}")
    if framework.db.active
      cred = credential_data.dup
      cred[:port] = 161
      cred[:protocol] = 'udp'
      cred[:service_name] = 'snmp'
      cred[:private_data] = community.to_s
      create_credential_and_login(cred)
    end
  end

  # ,nm:['506f727431','506f727432','506f727433','506f727434','506f727435','506f727436','506f727437','506f727438','506f727439','506f72743130','506f72743131','506f72743132','506f72743133','506f72743134','506f72743135','506f72743136','506f72743137','506f72743138','506f72743139','506f72743230','506f72743231','506f72743232','506f72743233','75706c696e6b','53465031','53465032']}
  if /,nm:\[(?<interfaces>[a-f\d',]*)\]/ =~ config
    interfaces = interfaces.split(',')
    interfaces.each_with_index do |iface, i|
      iface = iface.gsub("'", '')
      iface = Array(iface).pack('H*')
      next if iface == "Port#{i + 1}" || /SFP\d/ =~ iface # skip defaults

      print_status("#{thost}:#{tport} Port #{i + 1} Named: #{iface}")
    end
  end

end

#values_to_hash(line) ⇒ Object

this takes a string of config like ‘add connect-to=10.99.99.99 name=l2tp-hm password=123 user=l2tp-hm’ and converts it to a hash of keys and values for easier processing

# File 'lib/msf/core/auxiliary/mikrotik.rb', line 60

def values_to_hash(line)
  return {} unless line.is_a? String

  hash = {}
  array = line.split(' ')
  array.each do |setting|
    key_value = setting.split('=')
    unless key_value.length == 2
      next # skip things like 'add'
    end
    # verbose mode gives empty fields, however our processing makes them "" instead of empty
    # so we check if its empty and skip it to prevent a double quote or escaped double quote
    # field from being loaded
    next if key_value[1].strip == '""' || key_value[1].strip == '\\"\\"'

    hash[key_value[0].strip] = key_value[1].strip
  end
  hash
end