{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"La vulnerabilidad de retroceso en RouterOS compromete cientos de miles de dispositivos","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"La
\n
\nLa posibilidad de degradar remotamente dispositivos basados en RouterOS (Mikrotik) pone en riesgo cientos de miles de dispositivos de red. La vulnerabilidad est\u00e1 relacionada con el envenenamiento de la cach\u00e9 DNS del protocolo Winbox y permite cargar un firmware obsoleto (con la contrase\u00f1a restablecida a 'por defecto') o modificado en el dispositivo.
\n<\/a><\/noindex>
\n\"La
\n<\/p>\n

Detalles de la vulnerabilidad<\/h3>\n

\nEl terminal de RouterOS admite un comando de resoluci\u00f3n para buscar DNS.<\/p>\n

\"La
\n
\nEsta solicitud es procesada por un archivo binario llamado resolver. Resolver es uno de los muchos archivos binarios que est\u00e1n conectados al protocolo Winbox de RouterOS. A un alto nivel, los 'mensajes' enviados al puerto de Winbox pueden ser enrutados a diferentes archivos binarios en RouterOS seg\u00fan un esquema de numeraci\u00f3n basado en un array.<\/p>\n

Por defecto, la funci\u00f3n de servidor DNS est\u00e1 desactivada en RouterOS.<\/p>\n

\"La
\n
\nSin embargo, incluso con la funci\u00f3n del servidor desactivada, el enrutador mantiene su propia cach\u00e9 DNS.<\/p>\n

\"La
\n
\nCuando hacemos una consulta utilizando winbox_dns_request, por ejemplo, example.com, el enrutador almacenar\u00e1 en cach\u00e9 el resultado.<\/p>\n

\"La
\n
\nComo podemos especificar el servidor DNS a trav\u00e9s del cual debe pasar la consulta, ingresar direcciones incorrectas es trivial. Por ejemplo, se puede configurar la implementaci\u00f3n del servidor DNS de Philipp Klaus<\/a><\/noindex>, para responder siempre con un registro A que contenga la direcci\u00f3n IP 192.168.88.250.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nAhora, si buscamos example.com con Winbox, podemos ver que la cach\u00e9 DNS del enrutador est\u00e1 envenenada.<\/p>\n
\"La
\n
\nPor supuesto, envenenar example.com no es muy \u00fatil, ya que el enrutador en realidad no lo utilizar\u00e1. Sin embargo, el enrutador necesita hacer consultas a upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com y download.mikrotik.com. Y gracias a otro error, hay posibilidad de envenenarlos a todos a la vez.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nEl enrutador solicita un permiso y nosotros proporcionamos cinco a cambio. El enrutador almacena en cach\u00e9 incorrectamente todas estas respuestas.<\/p>\n
\"La
\n
\nEs evidente que este ataque tambi\u00e9n es \u00fatil si el enrutador act\u00faa como servidor DNS, ya que permite atacar a los clientes del enrutador.<\/p>\n
Este ataque tambi\u00e9n permite explotar una vulnerabilidad m\u00e1s grave: hacer un downgrade o backporting de la versi\u00f3n de RouterOS. El atacante recrea la l\u00f3gica del servidor de actualizaciones, incluyendo el changelog, y enga\u00f1a a RouterOS para que considere una versi\u00f3n obsoleta (vulnerable) como actual. El peligro aqu\u00ed radica en que al \"actualizar\" la versi\u00f3n, la contrase\u00f1a del administrador se restablece al valor \"por defecto\" \u2014 \u00a1un atacante puede iniciar sesi\u00f3n con una contrase\u00f1a vac\u00eda!<\/p>\n
\r\n        \"Reproducir\r\n        
<\/div>\r\n    <\/div><\/center>
\nEl ataque es completamente funcional, a pesar de que el autor<\/a><\/noindex> implementa varios vectores adicionales relacionados, incluyendo la inserci\u00f3n de un backdoor en el firmware<\/a><\/noindex>, pero esto ya es una t\u00e9cnica excesiva y su uso para fines ileg\u00edtimos es ilegal.<\/p>\n
Protecci\u00f3n<\/h3>\n
\nDeshabilitar simplemente Winbox permite protegerse de estos ataques. A pesar de la conveniencia de la administraci\u00f3n a trav\u00e9s de Winbox, es mejor utilizar el protocolo SSH.
\n
Fuente: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47La vulnerabilidad de backport en RouterOS pone en riesgo a cientos de miles de dispositivos | ProHoster","description":"Oportunidad.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}