{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"Backport s\u00e5rbarhet i RouterOS hotar hundratusentals enheter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Backport
\n
\nM\u00f6jligheten att fj\u00e4rrnedgradera enheter baserade p\u00e5 RouterOS (Mikrotik) hotar hundratusentals n\u00e4tverksenheter. S\u00e5rbarheten \u00e4r kopplad till f\u00f6rgiftning av DNS-cachen f\u00f6r Winbox-protokollet och m\u00f6jligg\u00f6r uppladdning av en f\u00f6r\u00e5ldrad (med \u00e5terst\u00e4llning av l\u00f6senordet till \"standard\") eller modifierad firmware till enheten.
\n<\/a><\/noindex>
\n\"Backport
\n<\/p>\n

Detaljer om s\u00e5rbarheten<\/h3>\n

\nRouterOS-terminalen st\u00f6der resolution-kommandot f\u00f6r att s\u00f6ka DNS.<\/p>\n

\"Backport
\n
\nDenna beg\u00e4ran behandlas av en bin\u00e4r fil som heter resolver. Resolver \u00e4r en av m\u00e5nga bin\u00e4ra filer som \u00e4r kopplade till Winbox-protokollet i RouterOS. P\u00e5 en h\u00f6g niv\u00e5 kan \"meddelanden\" som skickas till Winbox-porten routas till olika bin\u00e4ra filer i RouterOS baserat p\u00e5 en array-baserad numreringsschema.<\/p>\n

Som standard \u00e4r DNS-serverfunktionen avst\u00e4ngd i RouterOS.<\/p>\n

\"Backport
\n
\nMen \u00e4ven med DNS-serverfunktionen avst\u00e4ngd, st\u00f6djer routern sin egen DNS-cache.<\/p>\n

\"Backport
\n
\nN\u00e4r vi g\u00f6r en beg\u00e4ran med winbox_dns_request, till exempel example.com, kommer routern att cacha resultatet.<\/p>\n

\"Backport
\n
\nEftersom vi kan specificera den DNS-server som beg\u00e4ran ska g\u00e5 igenom \u00e4r det trivalt att ange felaktiga adresser. Till exempel kan man konfigurera DNS-serverimplementationen av Filip Klaus<\/a><\/noindex>, f\u00f6r att alltid svara med en A-post som inneh\u00e5ller IP-adressen 192.168.88.250.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- Svar:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nNu om man s\u00f6ker efter example.com med Winbox kan man se att routerns DNS-cache \u00e4r f\u00f6rgiftad.<\/p>\n
\"Backport
\n
\nSj\u00e4lvklart \u00e4r f\u00f6rgiftning av example.com inte s\u00e4rskilt anv\u00e4ndbart, eftersom routern faktiskt inte kommer att anv\u00e4nda det. Men routern beh\u00f6ver kommunicera med upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com och download.mikrotik.com. Och tack vare en annan bugg finns det m\u00f6jlighet att f\u00f6rgifta dem alla p\u00e5 en g\u00e5ng.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- Svar:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nRoutern beg\u00e4r ett tillst\u00e5nd, men vi ger tillbaka fem. Routern cachar felaktigt alla dessa svar.<\/p>\n
\"Backport
\n
\nDet \u00e4r uppenbart att denna attack ocks\u00e5 \u00e4r anv\u00e4ndbar om routern fungerar som DNS-server, eftersom den g\u00f6r det m\u00f6jligt att attackera routerns klienter.<\/p>\n
Dessutom g\u00f6r denna attack det m\u00f6jligt att utnyttja en mer allvarlig s\u00e5rbarhet: att genomf\u00f6ra en nedgradering eller bak\u00e5tportering av versionen av RouterOS. Angriparen \u00e5terskapar logiken f\u00f6r uppdateringsservern, inklusive changelog, och f\u00e5r RouterOS att uppfatta en f\u00f6r\u00e5ldrad (s\u00e5rbar) version som aktuell. Gefaren h\u00e4r ligger i att vid \"uppdatering\" av versionen \u00e5terst\u00e4lls administrat\u00f6rens l\u00f6senord till standardv\u00e4rdet \u2013 en illavarslande kan f\u00e5 tillg\u00e5ng till systemet med ett tomt l\u00f6senord!<\/p>\n
\r\n        \"Spela\r\n        
<\/div>\r\n    <\/div><\/center>
\nAttacken fungerar helt, trots att f\u00f6rfattaren<\/a><\/noindex> implementerar ytterligare flera vektorer, som ocks\u00e5 inkluderar inb\u00e4ddning av en baksida i firmware<\/a><\/noindex>, men det \u00e4r redan en \u00f6verfl\u00f6dig teknik och att anv\u00e4nda den f\u00f6r illegitima \u00e4ndam\u00e5l \u00e4r olagligt.<\/p>\n
Skydd<\/h3>\n
\nEn enkel avst\u00e4ngning av Winbox g\u00f6r det m\u00f6jligt att skydda sig mot dessa attacker. Trots bekv\u00e4mligheten med administration via Winbox \u00e4r det b\u00e4ttre att anv\u00e4nda SSH-protokollet.
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Backport-s\u00e5rbarhet i RouterOS hotar hundratusentals enheter | ProHoster","description":"M\u00f6jlighet.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}