Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

MicroTik releases patches for several maintained branches of RouterOS. Since they described it as an urgent security fix, the authors of this post decided to see what the issue was. With LLMs finding the old bug so quickly, the turnaround for exploitation is insane right now.

While reviewing the changes, they noticed a change to the input validation on the username passed to the /nova/bin/login application within the SSH application.

An additional change was in monitoring. If the ops account belongs to the privilged group full, it would disable the account, log a warning, and mark the router as Flagged. This IoT likely means they wanted to stop an outgoing attack.

When connecting to a server via SSH, the client has a Trust on First Use (TOFU) model. After the initial key exchange, either side can initiate a rekey. On vulnerable versions of RouterOS SSH, the server handled this incorrectly. When a rekey finished, the server moved from the temporary rekey state to channel handling instead of resuming the interrupted authentication. Thus, this allowed the connection to move from user authentication to channel handling, even though no real authentication had taken place.

When a client opens a session channel, the server creates a pseudoterminal with a login process. The username parameter is vulnerable to parameter injection, where CLI parameters can be changed with a username that contains a -. If you add the -N flag, it can read the username and effective SSH policy from a file descriptor.

By using a file descriptor of -2, an attacker can trigger an error through the SSH channel. Since you control the inputs being used for SSH, you can use this to log in as any user on the system. Obviously, this is very bad. Why not just use the standard SSH!?

To learn all of this information, they used GPT 5.5 cyber, and GPT 5.6 sol that was hooked up to radare2, and Ghidra, alongside the full RouterOS system. With over 40 virtual machines set up, the models had a strong way to reverse-engineer the system. I find it interesting that they found the vulnerability in this complicated state machine, which required two bugs to exploit. Pretty neat!

Overall, a good blog post on a really bad bug in MikroTik, as well as the patch analysis tooling used for it.