{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"La vuln\u00e9rabilit\u00e9 Backport dans RouterOS met en danger des centaines de milliers d'appareils.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"La
\n
\nLa possibilit\u00e9 de d\u00e9classer \u00e0 distance des appareils bas\u00e9s sur RouterOS (Mikrotik) met en p\u00e9ril des centaines de milliers de dispositifs r\u00e9seau. La vuln\u00e9rabilit\u00e9 est li\u00e9e \u00e0 l'empoisonnement du cache DNS du protocole Winbox et permet de charger un firmware ancien (avec une r\u00e9initialisation du mot de passe \u00ab par d\u00e9faut \u00bb) ou modifi\u00e9 sur l'appareil.
\n<\/a><\/noindex>
\n\"La
\n<\/p>\n

D\u00e9tails sur la vuln\u00e9rabilit\u00e9<\/h3>\n

\nLe terminal RouterOS prend en charge la commande de r\u00e9solution pour rechercher des DNS.<\/p>\n

\"La
\n
\nCette requ\u00eate est trait\u00e9e par un fichier binaire nomm\u00e9 resolver. Resolver est l'un des nombreux fichiers binaires connect\u00e9s au protocole Winbox de RouterOS. \u00c0 un niveau \u00e9lev\u00e9, les \u00ab messages \u00bb envoy\u00e9s sur le port Winbox peuvent \u00eatre redirig\u00e9s vers diff\u00e9rents fichiers binaires dans RouterOS en fonction d'un sch\u00e9ma de num\u00e9rotation bas\u00e9 sur un tableau.<\/p>\n

Par d\u00e9faut, la fonction de serveur DNS est d\u00e9sactiv\u00e9e dans RouterOS.<\/p>\n

\"La
\n
\nCependant, m\u00eame avec la fonction de serveur d\u00e9sactiv\u00e9e, le routeur maintient son propre cache DNS.<\/p>\n

\"La
\n
\nLorsque nous faisons une requ\u00eate en utilisant winbox_dns_request, par exemple, example.com, le routeur mettra en cache le r\u00e9sultat.<\/p>\n

\"La
\n
\nPuisque nous pouvons sp\u00e9cifier le serveur DNS par lequel la requ\u00eate doit passer, entrer de fausses adresses est trivial. Par exemple, on peut configurer une impl\u00e9mentation de serveur DNS de Philippe Klaus<\/a><\/noindex>, pour toujours r\u00e9pondre avec un enregistrement A contenant l'adresse IP 192.168.88.250.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- R\u00e9ponse:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nMaintenant, si on recherche example.com avec Winbox, on peut voir que le cache DNS du routeur est empoisonn\u00e9.<\/p>\n
\"La
\n
\nBien s\u00fbr, l\u2019empoisonnement de example.com n\u2019est pas tr\u00e8s utile, car le routeur ne va en fait pas l'utiliser. N\u00e9anmoins, le routeur doit se connecter \u00e0 upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com et download.mikrotik.com. Et gr\u00e2ce \u00e0 une autre erreur, il y a une possibilit\u00e9 d'empoisonner tous ces derniers simultan\u00e9ment.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- R\u00e9ponse:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nLe routeur demande une autorisation, et nous en fournissons cinq en retour. Le routeur met en cache toutes ces r\u00e9ponses de mani\u00e8re incorrecte.<\/p>\n
\"La
\n
\nIl est \u00e9vident que cette attaque est \u00e9galement utile si le routeur agit en tant que serveur DNS, car elle permet d'attaquer les clients du routeur.<\/p>\n
Cette attaque permet \u00e9galement d'exploiter une vuln\u00e9rabilit\u00e9 plus s\u00e9rieuse : effectuer un downgrade ou un backport de la version de RouterOS. L'attaquant recr\u00e9e la logique du serveur de mises \u00e0 jour, y compris le changelog, et contraint RouterOS \u00e0 consid\u00e9rer une version obsol\u00e8te (vuln\u00e9rable) comme \u00e9tant actuelle. Le danger ici r\u00e9side dans le fait qu'en \u00ab actualisant \u00bb la version, le mot de passe administrateur est r\u00e9initialis\u00e9 \u00e0 la valeur \u00ab par d\u00e9faut \u00bb - l'attaquant peut alors se connecter avec un mot de passe vide !<\/p>\n
\r\n        \"Lire\r\n        
<\/div>\r\n    <\/div><\/center>
\nL'attaque fonctionne parfaitement, m\u00eame si l'auteur<\/a><\/noindex> met en \u0153uvre plusieurs autres vecteurs, y compris l'insertion d'un backdoor dans le firmware<\/a><\/noindex>, mais c'est d\u00e9j\u00e0 une technique excessive et son utilisation \u00e0 des fins ill\u00e9gitimes est ill\u00e9gale.<\/p>\n
Protection<\/h3>\n
\nD\u00e9sactiver simplement Winbox permet de se prot\u00e9ger contre ces attaques. Malgr\u00e9 la facilit\u00e9 d'administration via Winbox, il est pr\u00e9f\u00e9rable d'utiliser le protocole SSH.
\n
Source : habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47La vuln\u00e9rabilit\u00e9 de backport dans RouterOS met en p\u00e9ril des centaines de milliers de dispositifs | ProHoster","description":"Possibilit\u00e9.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}