{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"A RouterOS backport s\u00e9r\u00fcl\u00e9kenys\u00e9g sz\u00e1mos eszk\u00f6z biztons\u00e1g\u00e1t vesz\u00e9lyezteti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"A
\n
\nA RouterOS (Mikrotik) alap\u00fa eszk\u00f6z\u00f6k t\u00e1voli visszamin\u0151s\u00edt\u00e9s\u00e9nek lehet\u0151s\u00e9ge sz\u00e1mos h\u00e1l\u00f3zati eszk\u00f6zt vesz\u00e9lyeztet. A sebezhet\u0151s\u00e9g a Winbox protokoll DNS gyors\u00edt\u00f3t\u00e1r\u00e1nak manipul\u00e1l\u00e1s\u00e1val kapcsolatos, \u00e9s lehet\u0151v\u00e9 teszi elavult (az alap\u00e9rtelmezett jelsz\u00f3 vissza\u00e1ll\u00edt\u00e1s\u00e1val) vagy m\u00f3dos\u00edtott firmware bet\u00f6lt\u00e9s\u00e9t az eszk\u00f6zre.
\n<\/a><\/noindex>
\n\"A
\n<\/p>\n

A sebezhet\u0151s\u00e9g r\u00e9szletei<\/h3>\n

\nA RouterOS termin\u00e1l t\u00e1mogatja a felold\u00e1si parancsot a DNS keres\u00e9s\u00e9re.<\/p>\n

\"A
\n
\nEz a k\u00e9r\u00e9s egy resolver nev\u0171 bin\u00e1ris f\u00e1jl \u00e1ltal ker\u00fcl feldolgoz\u00e1sra. A Resolver egyike a sz\u00e1mos, a RouterOS Winbox protokollhoz csatlakoztatott bin\u00e1ris f\u00e1jloknak. Magas szinten a Winbox portj\u00e1ra k\u00fcld\u00f6tt \"\u00fczenetek\" a sz\u00e1moz\u00e1si s\u00e9ma alapj\u00e1n k\u00fcl\u00f6nb\u00f6z\u0151 bin\u00e1ris f\u00e1jlokhoz ir\u00e1ny\u00edthat\u00f3k RouterOS-en bel\u00fcl.<\/p>\n

Alap\u00e9rtelmez\u00e9s szerint a RouterOS DNS-szolg\u00e1ltat\u00e1si funkci\u00f3ja ki van kapcsolva.<\/p>\n

\"A
\n
\nAzonban m\u00e9g ki kapcsolt DNS-szolg\u00e1ltat\u00e1s mellett is, a router saj\u00e1t DNS gyors\u00edt\u00f3t\u00e1rat fenntart.<\/p>\n

\"A
\n
\nAmikor k\u00e9rd\u00e9st tesz\u00fcnk fel a winbox_dns_request seg\u00edts\u00e9g\u00e9vel, p\u00e9ld\u00e1ul example.com, a router gyors\u00edtja a v\u00e1laszt.<\/p>\n

\"A
\n
\nMivel megadhatjuk a DNS-szolg\u00e1ltat\u00f3t, amelyen a k\u00e9r\u00e9snek \u00e1t kell mennie, roppant egyszer\u0171 hamis c\u00edmeket be\u00e1ll\u00edtani. P\u00e9ld\u00e1ul be\u00e1ll\u00edthat\u00f3 egy DNS-szolg\u00e1ltat\u00e1s a Philipp Klaus-t\u00f3l<\/a><\/noindex>, amely mindig A rekorddal v\u00e1laszol, ami a 192.168.88.250 IP c\u00edmet tartalmazza.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- V\u00e1lasz:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nMost, ha Winbox seg\u00edts\u00e9g\u00e9vel megkeress\u00fck az example.com-ot, l\u00e1that\u00f3, hogy a router DNS gyors\u00edt\u00f3t\u00e1ra meg van m\u00e9rgezve.<\/p>\n
\"A
\n
\nTerm\u00e9szetesen az example.com megm\u00e9rgez\u00e9se nem t\u00fal hasznos, mivel a router ennek t\u00e9nylegesen nem fogja haszn\u00e1lni. Mindazon\u00e1ltal a routernek sz\u00fcks\u00e9ge van az upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com \u00e9s download.mikrotik.com el\u00e9r\u00e9s\u00e9re. \u00c9s egy \u00fajabb hiba r\u00e9v\u00e9n lehet\u0151s\u00e9g van az \u00f6sszes egyidej\u0171 megm\u00e9rgez\u00e9s\u00e9re.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- V\u00e1lasz:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nA router requests one permission, and we provide five in return. The router incorrectly caches all these responses.<\/p>\n
\"A
\n
\nIt is clear that this attack is also useful if the router acts as a DNS server, as it allows the attacker to target the router's clients.<\/p>\n
This attack also enables the exploitation of a more serious vulnerability: downgrading or backporting the RouterOS version. The attacker recreates the update server's logic, including the changelog, and tricks RouterOS into thinking an outdated (vulnerable) version is current. The danger here is that during the version 'upgrade', the administrator password is reset to 'default' \u2013 the attacker can gain access with an empty password!<\/p>\n
\r\n        \"Vide\u00f3\r\n        
<\/div>\r\n    <\/div><\/center>
\nThe attack is quite effective, even though the author<\/a><\/noindex> implements several other vectors, including embedding a backdoor in the firmware<\/a><\/noindex>, but that is already an excessive technique, and using it for illegitimate purposes is illegal.<\/p>\n
V\u00e9delem<\/h3>\n
\nSimply disabling Winbox provides protection against these attacks. Despite the convenience of administration through Winbox, it is better to use the SSH protocol.
\n
Forr\u00e1s: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The backport vulnerability in RouterOS endangers hundreds of thousands of devices | ProHoster","description":"Possibility.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}