mikrotikapi-bf 3.5.4__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. mikrotikapi_bf-3.5.4/LICENSE +21 -0
  2. mikrotikapi_bf-3.5.4/PKG-INFO +559 -0
  3. mikrotikapi_bf-3.5.4/README.md +514 -0
  4. mikrotikapi_bf-3.5.4/core/__init__.py +26 -0
  5. mikrotikapi_bf-3.5.4/core/api.py +272 -0
  6. mikrotikapi_bf-3.5.4/core/cli.py +325 -0
  7. mikrotikapi_bf-3.5.4/core/export.py +140 -0
  8. mikrotikapi_bf-3.5.4/core/log.py +127 -0
  9. mikrotikapi_bf-3.5.4/core/progress.py +143 -0
  10. mikrotikapi_bf-3.5.4/core/retry.py +129 -0
  11. mikrotikapi_bf-3.5.4/core/session.py +260 -0
  12. mikrotikapi_bf-3.5.4/mikrotikapi_bf/__init__.py +25 -0
  13. mikrotikapi_bf-3.5.4/mikrotikapi_bf/cli.py +61 -0
  14. mikrotikapi_bf-3.5.4/mikrotikapi_bf/nse_installer.py +200 -0
  15. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/PKG-INFO +559 -0
  16. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/SOURCES.txt +36 -0
  17. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/dependency_links.txt +1 -0
  18. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/entry_points.txt +4 -0
  19. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/requires.txt +15 -0
  20. mikrotikapi_bf-3.5.4/mikrotikapi_bf.egg-info/top_level.txt +4 -0
  21. mikrotikapi_bf-3.5.4/modules/__init__.py +22 -0
  22. mikrotikapi_bf-3.5.4/modules/decoder.py +620 -0
  23. mikrotikapi_bf-3.5.4/modules/discovery.py +190 -0
  24. mikrotikapi_bf-3.5.4/modules/fingerprint.py +312 -0
  25. mikrotikapi_bf-3.5.4/modules/mac_server.py +427 -0
  26. mikrotikapi_bf-3.5.4/modules/proxy.py +130 -0
  27. mikrotikapi_bf-3.5.4/modules/reports.py +214 -0
  28. mikrotikapi_bf-3.5.4/modules/stealth.py +144 -0
  29. mikrotikapi_bf-3.5.4/modules/wordlists.py +178 -0
  30. mikrotikapi_bf-3.5.4/pyproject.toml +91 -0
  31. mikrotikapi_bf-3.5.4/setup.cfg +4 -0
  32. mikrotikapi_bf-3.5.4/setup.py +50 -0
  33. mikrotikapi_bf-3.5.4/xpl/__init__.py +41 -0
  34. mikrotikapi_bf-3.5.4/xpl/cve_db.py +873 -0
  35. mikrotikapi_bf-3.5.4/xpl/exploits.py +3000 -0
  36. mikrotikapi_bf-3.5.4/xpl/npk_decoder.py +322 -0
  37. mikrotikapi_bf-3.5.4/xpl/nvd_shodan.py +332 -0
  38. mikrotikapi_bf-3.5.4/xpl/scanner.py +311 -0
mikrotikapi_bf-3.5.4/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2022-2026 AndrΓ© Henrique (https://github.com/mrhenrike)
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
mikrotikapi_bf-3.5.4/PKG-INFO ADDED
@@ -0,0 +1,559 @@
1
+ Metadata-Version: 2.4
2
+ Name: mikrotikapi-bf
3
+ Version: 3.5.4
4
+ Summary: RouterOS Attack & Exploitation Framework β€” credential brute-force, CVE scanner, MAC-Server, decoders
5
+ Author-email: AndrΓ© Henrique <mrhenrike@users.noreply.github.com>
6
+ Maintainer-email: AndrΓ© Henrique <mrhenrike@users.noreply.github.com>
7
+ License-Expression: MIT
8
+ Project-URL: Homepage, https://github.com/mrhenrike/MikrotikAPI-BF
9
+ Project-URL: Repository, https://github.com/mrhenrike/MikrotikAPI-BF
10
+ Project-URL: Documentation, https://github.com/mrhenrike/MikrotikAPI-BF/wiki
11
+ Project-URL: Bug Tracker, https://github.com/mrhenrike/MikrotikAPI-BF/issues
12
+ Project-URL: Changelog, https://github.com/mrhenrike/MikrotikAPI-BF/releases
13
+ Keywords: mikrotik,routeros,brute-force,security,pentest,cve,exploit,iot,nmap,nse,network-security
14
+ Classifier: Development Status :: 5 - Production/Stable
15
+ Classifier: Environment :: Console
16
+ Classifier: Intended Audience :: Information Technology
17
+ Classifier: Intended Audience :: Science/Research
18
+ Classifier: Operating System :: OS Independent
19
+ Classifier: Programming Language :: Python :: 3
20
+ Classifier: Programming Language :: Python :: 3.8
21
+ Classifier: Programming Language :: Python :: 3.9
22
+ Classifier: Programming Language :: Python :: 3.10
23
+ Classifier: Programming Language :: Python :: 3.11
24
+ Classifier: Programming Language :: Python :: 3.12
25
+ Classifier: Topic :: Security
26
+ Classifier: Topic :: System :: Networking :: Monitoring
27
+ Requires-Python: >=3.8
28
+ Description-Content-Type: text/markdown
29
+ License-File: LICENSE
30
+ Requires-Dist: requests>=2.28.0
31
+ Requires-Dist: urllib3>=1.26.0
32
+ Requires-Dist: colorama>=0.4.6
33
+ Requires-Dist: paramiko>=2.7.0
34
+ Requires-Dist: PySocks>=1.7.1
35
+ Requires-Dist: PyYAML>=6.0
36
+ Requires-Dist: beautifulsoup4>=4.12.0
37
+ Requires-Dist: python-dotenv>=1.0.0
38
+ Provides-Extra: dev
39
+ Requires-Dist: pytest>=7.0; extra == "dev"
40
+ Requires-Dist: pytest-cov; extra == "dev"
41
+ Requires-Dist: black; extra == "dev"
42
+ Requires-Dist: isort; extra == "dev"
43
+ Requires-Dist: flake8; extra == "dev"
44
+ Dynamic: license-file
45
+
46
+ # MikrotikAPI-BF v3.5.4
47
+
48
+ [![Python Version](https://img.shields.io/badge/python-3.8%20%7C%203.9%20%7C%203.10%20%7C%203.11%20%7C%203.12-blue.svg)](https://www.python.org/downloads/)
49
+ [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
50
+ [![Version](https://img.shields.io/badge/version-3.5.4-red.svg)](https://github.com/mrhenrike/MikrotikAPI-BF/releases/tag/v3.5.4)
51
+ [![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey.svg)](README.md)
52
+ [![Wiki](https://img.shields.io/badge/Wiki-GitHub-orange)](https://github.com/mrhenrike/MikrotikAPI-BF/wiki)
53
+ [![PyPI](https://img.shields.io/badge/pip-mikrotikapi--bf-blue)](https://pypi.org/project/mikrotikapi-bf/)
54
+ [![CodeQL](https://github.com/mrhenrike/MikrotikAPI-BF/actions/workflows/codeql.yml/badge.svg)](https://github.com/mrhenrike/MikrotikAPI-BF/actions/workflows/codeql.yml)
55
+
56
+ **RouterOS Attack & Exploitation Framework** β€” credential brute-force, **40 CVE/EDB PoC exploits**, MAC-Server Layer-2 discovery, offline credential decoders, NPK analyzer, CVE scanner, Nmap NSE scripts, multi-target, stealth, REST/API/Winbox/FTP/SSH/Telnet/SMB/SNMP/BFD/OSPF vectors.
57
+
58
+ **Portuguese (pt-BR):** [README.pt-BR.md](README.pt-BR.md) Β· **Contributing:** [CONTRIBUTING.md](CONTRIBUTING.md) Β· **Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) Β· **Security:** [SECURITY.md](SECURITY.md)
59
+
60
+ ---
61
+
62
+ ## ✨ Key Features
63
+
64
+ ### πŸ” Authentication & Brute-Force
65
+ - **RouterOS API** (TCP 8728/8729) β€” full binary protocol implementation (6.x MD5 challenge + 7.x plaintext)
66
+ - **REST API** over HTTP/HTTPS (TCP 80/443) β€” Basic Auth brute-force
67
+ - **MAC-Telnet** (TCP 20561) β€” Layer-2 proprietary protocol (no IP needed)
68
+ - **Multi-target** (`--target-list / -T`) β€” scan from file, sequential engine per target
69
+ - **Threading** β€” up to 15 workers (`--threads N`)
70
+
71
+ ### πŸ” CVE Scanner & Exploit Engine
72
+ - **40 exploit classes** β€” 22 CVEs + 2 design findings + 13 Exploit-DB PoCs + 5 new CVEs
73
+ - **Pre-auth exploits** β€” Winbox (CVE-2018-14847, CVE-2018-10066), HTTP traversal, SNMP, SMB, BFD, OSPF, DNS
74
+ - **Post-auth exploits** β€” Scheduler RCE, Container escalation, FOISted, WireGuard key extraction, packet sniffer wiretapping
75
+ - **Version-aware** β€” CVE database maps applicability to detected RouterOS version
76
+ - **`--scan-cve`** β€” standalone CVE scan (no brute-force needed)
77
+
78
+ ### 🌐 Winbox CVE Coverage (TCP 8291)
79
+ - **CVE-2018-14847** β€” Credential disclosure (Chimay-Red / EternalWink) β€” pre-auth file read
80
+ - **CVE-2018-10066** β€” Authentication bypass / directory traversal
81
+ - **CVE-2021-27263** β€” Auth bypass (RouterOS 7.0.x)
82
+ - **CVE-2018-14847-MAC** β€” Same exploit delivered via MNDP Layer-2 discovery
83
+ - **NSE script** β€” `nse/mikrotik-winbox-cve-2018-14847.nse` (Nmap integration)
84
+
85
+ > ℹ️ Winbox **credential brute-force** via the proprietary Winbox GUI protocol is not implemented (no reliable portable auth library). Use API port 8728 for brute-force. All **Winbox CVE exploits** (pre-auth file read, bypass) are fully implemented.
86
+
87
+ ### πŸ›°οΈ MAC-Server / Layer-2 Discovery (v3.3.0+)
88
+ - **MNDP broadcast** (UDP 20561) β€” discovers devices even without IP
89
+ - **MAC-Telnet brute-force** (TCP 20561) β€” proprietary MAC-Telnet auth
90
+ - **CVE-2018-14847-MAC** β€” Winbox credential disclosure via MNDP-discovered devices
91
+ - **L2 constraint** β€” requires same broadcast domain
92
+
93
+ ### πŸ”“ Offline Credential Decoders (v3.5.0+)
94
+ Based on [mikrotik-tools](https://github.com/0ki/mikrotik-tools) by Kirils Solovjovs, ported to Python 3:
95
+ - **`--decode-userdat`** β€” decode `user.dat` after CVE-2018-14847 extraction (XOR with MD5 key)
96
+ - **`--decode-backup`** β€” extract `.backup` archive + auto-decode credentials
97
+ - **`--decode-supout`** β€” list sections in `supout.rif` diagnostic files
98
+ - **`--analyze-npk`** β€” NPK package analyzer (CVE-2019-3977 vector)
99
+
100
+ ### πŸ—ΊοΈ Nmap NSE Scripts (v3.5.4+)
101
+ Five Lua scripts in `nse/` for Nmap integration:
102
+ - `mikrotik-routeros-version.nse` β€” fingerprint RouterOS from HTTP/API/Winbox
103
+ - `mikrotik-api-brute.nse` β€” full API brute-force (6.x MD5 + 7.x plaintext auth)
104
+ - `mikrotik-default-creds.nse` β€” test default/empty creds on all interfaces
105
+ - `mikrotik-api-info.nse` β€” authenticated info dump (users, services, firewall)
106
+ - `mikrotik-winbox-cve-2018-14847.nse` β€” Winbox credential disclosure check
107
+
108
+ ### 🎯 Wordlists
109
+ - Compatible with [mrhenrike/WordListsForHacking](https://github.com/mrhenrike/WordListsForHacking)
110
+ - Includes `labs_mikrotik_pass.lst` (MikroTik-specific), `labs_passwords.lst`, `labs_users.lst`
111
+ - Smart wordlist engine with target-informed combinations
112
+
113
+ ### πŸ”„ Sessions, Stealth & Export
114
+ - **Persistent sessions** β€” resume interrupted attacks (`--resume`)
115
+ - **Stealth mode** β€” Fibonacci delays, User-Agent rotation (`--stealth`)
116
+ - **Progress bar** β€” ETA and speed display (`--progress`)
117
+ - **Export** β€” JSON, CSV, XML, TXT (`--export-all`)
118
+ - **Proxy** β€” SOCKS5/HTTP proxy support (`--proxy socks5://...`)
119
+
120
+ ---
121
+
122
+ ## πŸš€ Quick Start
123
+
124
+ ### Install via pip
125
+
126
+ ```bash
127
+ pip install git+https://github.com/mrhenrike/MikrotikAPI-BF.git
128
+ # or (when on PyPI):
129
+ pip install mikrotikapi-bf
130
+
131
+ mikrotikapi-bf --help
132
+ mikrotikapi-bf --nse-path # prints NSE scripts directory for Nmap
133
+ ```
134
+
135
+ ### Install from source
136
+
137
+ ```bash
138
+ git clone https://github.com/mrhenrike/MikrotikAPI-BF.git
139
+ cd MikrotikAPI-BF
140
+ pip install -r requirements.txt
141
+ python mikrotikapi-bf.py --help
142
+ ```
143
+
144
+ ### One-liners
145
+
146
+ ```bash
147
+ # Basic brute-force
148
+ python mikrotikapi-bf.py -t 192.168.1.1 -U admin -d wordlists/passwords.lst
149
+
150
+ # Username + password lists
151
+ python mikrotikapi-bf.py -t 192.168.1.1 -u users.lst -p passwords.lst
152
+
153
+ # Multi-target from file
154
+ python mikrotikapi-bf.py -T targets.lst -d passwords.lst --threads 5
155
+
156
+ # Full CVE scan (authenticated)
157
+ python mikrotikapi-bf.py -t 192.168.1.1 --scan-cve --all-cves -U admin -P pass
158
+
159
+ # Full pentest run
160
+ python mikrotikapi-bf.py \
161
+ -t 192.168.1.1 \
162
+ -u wordlists/users.lst -p wordlists/passwords.lst \
163
+ --validate ftp,ssh,telnet \
164
+ --stealth --fingerprint --progress --export-all \
165
+ --threads 5 -vv
166
+
167
+ # Decode user.dat after CVE-2018-14847 extraction
168
+ python mikrotikapi-bf.py --decode-userdat user.dat --decode-useridx user.idx
169
+
170
+ # Layer-2 MAC-Server attack
171
+ python mikrotikapi-bf.py --mac-discover --mac-brute -d passwords.lst
172
+ ```
173
+
174
+ ### Nmap NSE Usage
175
+
176
+ ```bash
177
+ # Install NSE scripts
178
+ cp nse/*.nse /usr/share/nmap/scripts/ && nmap --script-updatedb
179
+
180
+ # Full discovery
181
+ nmap -p 80,8291,8728 --script "mikrotik-*" 192.168.1.0/24
182
+
183
+ # Check CVE-2018-14847
184
+ nmap -p 8291 --script mikrotik-winbox-cve-2018-14847 192.168.1.1
185
+
186
+ # Brute-force API
187
+ nmap -p 8728 --script mikrotik-api-brute \
188
+ --script-args userdb=users.lst,passdb=passwords.lst 192.168.1.1
189
+ ```
190
+
191
+ ---
192
+
193
+ ## πŸ—ΊοΈ Attack Surface Mapping
194
+
195
+ ### Full Attack Surface β€” Coverage Status (v3.5.4)
196
+
197
+ ![MikrotikAPI-BF Full Attack Surface Map](img/mikrotik_full_attack_surface.png)
198
+
199
+ *Complete RouterOS attack surface with MikrotikAPI-BF coverage indicators (βœ“ covered / βœ— not yet covered)*
200
+
201
+ ---
202
+
203
+ ### 🟠 Access Vectors β€” Coverage Detail
204
+
205
+ ![Access Vectors Coverage](img/mikrotik_access_vectors.png)
206
+
207
+ *Orange = Access Vectors. Green βœ“ = covered. Red βœ— = not yet covered.*
208
+
209
+ | Access Vector | Port(s) | Tool Coverage | How |
210
+ |--------------|---------|--------------|-----|
211
+ | **telnet** | TCP/23 | βœ… Covered | Post-login validation (`--validate telnet`) |
212
+ | **ssh** | TCP/22 | βœ… Covered | Post-login validation + EDB-28056 (ROSSSH heap) |
213
+ | **web** (WebFig/REST) | TCP/80, 443 | βœ… Covered | REST API brute-force + 10+ CVE/EDB exploits |
214
+ | **winbox** | TCP/8291 | βœ… Covered | CVE-2018-14847, CVE-2018-10066, CVE-2021-27263 + NSE script |
215
+ | **ftp** | TCP/21 | βœ… Covered | Post-login validation + CVE-2019-3976/3977 + EDB-44450 |
216
+ | **samba** (SMB) | TCP/445 | βœ… Covered | CVE-2018-7445, CVE-2022-45315 |
217
+ | **mactel** (MAC-Telnet) | TCP/20561 | βœ… Covered | `modules/mac_server.py` β€” MNDP + brute (v3.3.0+) |
218
+ | **dude** | TCP/2210 | ❌ Not covered | The Dude monitoring client β€” no PoC |
219
+ | **setup** (Netinstall) | UDP/5000 | ❌ Not covered | Physical/LAN boot vector |
220
+ | **netboot** | TFTP/69 | ❌ Not covered | Physical LAN only |
221
+ | **btest** | TCP/2000 | ❌ Not covered | Bandwidth Test β€” protocol not implemented |
222
+ | **dhcp** | UDP/67-68 | ❌ Not covered | Out of scope |
223
+ | **console** | RS-232 | ❌ Not covered | Physical serial access only |
224
+ | **Woobm-USB** | USB | ❌ Not covered | Physical access only |
225
+
226
+ **Coverage: 7 / 14 Access Vectors (50%) β€” all network-accessible vectors covered**
227
+
228
+ ---
229
+
230
+ ### πŸ”΅ Access Targets β€” Coverage Detail
231
+
232
+ ![Access Targets Coverage](img/mikrotik_access_targets.png)
233
+
234
+ *Blue = Access Targets. Green βœ“ = covered. Red βœ— = not yet covered.*
235
+
236
+ | Access Target | Component | Coverage | CVEs / Notes |
237
+ |--------------|-----------|---------|--------------|
238
+ | **filesystem** | `/flash/rw/store/` | ⚠️ Partial | CVE-2018-14847 reads `user.dat`; CVE-2019-3943 path traversal |
239
+ | **supout.rif** | Diagnostic file | βœ… Covered | CVE-2023-30799 (FOISted) β€” priv escalation via supout upload |
240
+ | **.npk** | Package files | βœ… Covered | CVE-2019-3977/3976 β€” arbitrary exec/read via NPK |
241
+ | **.backup** | Config backup | ❌ Not covered | No exploit for backup file extraction/abuse |
242
+ | **FLASH** | Internal flash | ❌ Not covered | Requires filesystem or physical access |
243
+ | **NAND** | NAND storage | ❌ Not covered | Low-level, physical access |
244
+ | **HDD** | Hard disk (CHR) | ❌ Not covered | CHR-specific β€” no direct exploit path |
245
+ | **kvm** | Virtual machine | ❌ Not covered | KVM hypervisor β€” out of scope |
246
+
247
+ ---
248
+
249
+ ## πŸ“„ CLI Reference (All Flags)
250
+
251
+ | Flag | Short | Description | Default |
252
+ |------|-------|-------------|---------|
253
+ | `--target` | `-t` | Target IP/hostname | β€” |
254
+ | `--target-list` | `-T` | File with targets (one per line) | β€” |
255
+ | `--user` | `-U` | Single username | admin |
256
+ | `--passw` | `-P` | Single password | β€” |
257
+ | `--userlist` | `-u` | Username wordlist file | β€” |
258
+ | `--passlist` | `-p` | Password wordlist file | β€” |
259
+ | `--dictionary` | `-d` | Combo file (`user:pass`) | β€” |
260
+ | `--seconds` | `-s` | Delay between attempts (s) | 5 |
261
+ | `--threads` | β€” | Thread count (max 15) | 2 |
262
+ | `--api-port` | β€” | RouterOS API port | 8728 |
263
+ | `--rest-port` | β€” | RouterOS REST port | 8729 |
264
+ | `--http-port` | β€” | HTTP port | 80 |
265
+ | `--ssl` | β€” | Use HTTPS/API-SSL | false |
266
+ | `--ssl-port` | β€” | HTTPS port | 443 |
267
+ | `--validate` | β€” | Post-login validation (`ftp,ssh,telnet`) | β€” |
268
+ | `--verbose` | `-v` | Show failed attempts | false |
269
+ | `--verbose-all` | `-vv` | Full debug | false |
270
+ | `--progress` | β€” | Progress bar + ETA | false |
271
+ | `--stealth` | β€” | Stealth delays + UA rotation | false |
272
+ | `--fingerprint` | β€” | Advanced device fingerprinting | false |
273
+ | `--exploit` | β€” | Run exploit scanner after BF | false |
274
+ | `--scan-cve` | β€” | Standalone CVE scan (no BF) | false |
275
+ | `--all-cves` | β€” | Show all CVEs (ignore version) | false |
276
+ | `--proxy` | β€” | Proxy URL (`socks5://...`) | β€” |
277
+ | `--interactive` | β€” | Start interactive REPL | false |
278
+ | `--max-retries` | β€” | Connection retry count | 1 |
279
+ | `--export` | β€” | Formats: `json,csv,xml,txt` | β€” |
280
+ | `--export-all` | β€” | Export to all formats | false |
281
+ | `--export-dir` | β€” | Output directory | results |
282
+ | `--resume` | β€” | Resume previous session | false |
283
+ | `--force` | β€” | Force new session | false |
284
+ | `--list-sessions` | β€” | List saved sessions | β€” |
285
+ | `--mac-discover` | β€” | MNDP broadcast discovery | false |
286
+ | `--mac-brute` | β€” | Brute via MAC-Telnet | false |
287
+ | `--mac-scan-cve` | β€” | CVE-2018-14847-MAC | false |
288
+ | `--mac-iface-ip` | β€” | Local IP for MNDP | 0.0.0.0 |
289
+ | `--decode-userdat` | β€” | Decode `user.dat` offline | β€” |
290
+ | `--decode-useridx` | β€” | Companion `user.idx` | β€” |
291
+ | `--decode-backup` | β€” | Decode `.backup` archive | β€” |
292
+ | `--analyze-npk` | β€” | Analyze NPK package | β€” |
293
+ | `--decode-supout` | β€” | List `supout.rif` sections | β€” |
294
+
295
+ > **Full guide:** [Wiki β€” Complete Usage Guide](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/Complete-Usage-Guide) Β· [pt-BR](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/Complete-Usage-Guide-pt-BR)
296
+
297
+ ---
298
+
299
+ ## 🧭 Attack Surface Coverage by Service
300
+
301
+ | Service | Port | Brute-Force | CVE/Exploits | NSE Script |
302
+ |---------|------|------------|-------------|-----------|
303
+ | RouterOS API | TCP/8728 | βœ… Primary target | VUID 375660 | `mikrotik-api-brute.nse` |
304
+ | REST API | TCP/80,443 | βœ… HTTP Basic Auth | CVE-2019-3924, 2019-3943, 2023-30799, 2023-30800, 2024-35274 | `mikrotik-default-creds.nse` |
305
+ | Winbox | TCP/8291 | ⚠️ Not (no auth lib) | CVE-2018-14847, 2018-10066, 2021-27263 | `mikrotik-winbox-cve-2018-14847.nse` |
306
+ | FTP | TCP/21 | βœ… Post-login | CVE-2019-3976, 2019-3977, EDB-44450 | β€” |
307
+ | SSH | TCP/22 | βœ… Post-login | EDB-28056 (ROSSSH) | β€” |
308
+ | Telnet | TCP/23 | βœ… Post-login | β€” | β€” |
309
+ | SMB | TCP/445 | β€” | CVE-2018-7445, CVE-2022-45315 | β€” |
310
+ | SNMP | UDP/161 | β€” | EDB-31102, EDB-6366 | β€” |
311
+ | MAC-Telnet | TCP/20561 | βœ… L2 only | CVE-2018-14847-MAC | β€” |
312
+
313
+ ---
314
+
315
+ ## πŸ”Ž Full Exploit Coverage (40 entries)
316
+
317
+ | ID | Title | CVSS | Auth | PoC | Fixed in |
318
+ |----|-------|------|------|-----|---------|
319
+ | CVE-2018-7445 | SMB Stack Buffer Overflow | 9.8 | No | [EDB-44290](https://www.exploit-db.com/exploits/44290) | 6.41.4 |
320
+ | CVE-2018-10066 | Winbox Auth Bypass | 8.1 | No | [EDB-44813](https://www.exploit-db.com/exploits/44813) | 6.42 |
321
+ | CVE-2018-14847 | Winbox Credential Disclosure (Chimay-Red) | 9.1 | No | [EDB-45220](https://www.exploit-db.com/exploits/45220) | 6.42.1 |
322
+ | CVE-2018-14847-MAC | Winbox via MNDP (Layer-2) | 9.1 | No | β€” | 6.42.1 |
323
+ | CVE-2019-3924 | WWW Firewall/NAT Bypass | 9.8 | No | [EDB-46444](https://www.exploit-db.com/exploits/46444) βœ“ | 6.43.12 |
324
+ | CVE-2019-3943 | HTTP Path Traversal | 8.8 | No | [EDB-46731](https://www.exploit-db.com/exploits/46731) | 6.43.8 |
325
+ | CVE-2019-3976 | NPK Arbitrary File Read | 6.5 | Yes | β€” | 6.45.7 |
326
+ | CVE-2019-3977 | NPK Arbitrary Code Execution | 7.5 | Yes | β€” | 6.45.7 |
327
+ | CVE-2019-3978 | DNS Cache Poisoning | 7.5 | No | [EDB-47566](https://www.exploit-db.com/exploits/47566) | 6.45.7 |
328
+ | CVE-2019-3981 | DNS Forwarder MitM | 7.5 | No | β€” | 6.45.7 |
329
+ | CVE-2020-20215 | MPLS Out-of-Bounds Write (DoS) | 7.5 | Yes | β€” | 6.47 |
330
+ | CVE-2020-5720 | UDP Fragment Crash | 7.5 | Yes | β€” | 6.46.5 |
331
+ | CVE-2021-27263 | Winbox Auth Bypass (7.0.x) | 7.5 | No | β€” | 7.1 |
332
+ | CVE-2021-36522 | www Authenticated RCE via Scheduler | 8.8 | Yes | β€” | 6.49.3 |
333
+ | CVE-2021-41987 | RADIUS Client Buffer Overflow | 8.1 | No | β€” | 6.49.1/7.1 |
334
+ | CVE-2022-34960 | Container Privilege Escalation | 8.8 | Yes | β€” | 7.6 |
335
+ | CVE-2022-45313 | SMB Heap Use-After-Free | 8.8 | No | β€” | 6.49.7/7.6 |
336
+ | CVE-2022-45315 | SMB Authenticated Stack Overflow | 8.8 | Yes | [EDB-51451](https://www.exploit-db.com/exploits/51451) | 6.49.7 |
337
+ | CVE-2023-30799 | FOISted β€” supout.rif Privilege Escalation | 9.1 | Yes | β€” | 6.49.9 |
338
+ | CVE-2023-30800 | WWW Stack-Based Buffer Overflow | 8.2 | No | β€” | 6.49.9 |
339
+ | CVE-2024-27887 | OSPF Route Injection | 7.5 | No | β€” | β€” |
340
+ | CVE-2024-2169 | BFD Reflection/Amplification Loop | 7.5 | No | β€” | Mitigate |
341
+ | CVE-2024-35274 | Authenticated RCE via Scheduler Injection | 8.8 | Yes | β€” | Pending |
342
+ | CVE-2025-6563 | RouterOS 7.x WebFig XSS/Open Redirect | 6.1 | No | β€” | Pending |
343
+ | CVE-2017-20149 | www Password Exposure | 7.5 | No | β€” | 6.38.5 |
344
+ | MIKROTIK-CONFIG-001 | WireGuard Private Key Exposure | β€” | Yes | β€” | Design |
345
+ | MIKROTIK-CONFIG-002 | Packet Sniffer Remote Streaming | β€” | Yes | β€” | Design |
346
+ | EDB-31102 | RouterOS 3.x SNMP SET DoS | β€” | No | [EDB βœ“](https://www.exploit-db.com/exploits/31102) | ≀ 3.2 |
347
+ | EDB-6366 | RouterOS 3.x SNMP Unauthorized Write | β€” | No | [EDB βœ“](https://www.exploit-db.com/exploits/6366) | ≀ 3.13 |
348
+ | EDB-44283/44284 | Chimay-Red Stack Clash RCE (MIPSBE+x86) | 9.8 | No | [EDB](https://www.exploit-db.com/exploits/44283) | < 6.38.4 |
349
+ | EDB-44450 | FTP Daemon DoS | β€” | No | [EDB](https://www.exploit-db.com/exploits/44450) | 6.41.4 |
350
+ | EDB-43317 | ICMP DoS (6.40.5) | β€” | Yes | [EDB](https://www.exploit-db.com/exploits/43317) | 6.40.5 |
351
+ | EDB-41752 | RouterBoard DoS (6.38.5) | β€” | Yes | [EDB](https://www.exploit-db.com/exploits/41752) | 6.38.5 |
352
+ | EDB-41601 | ARP Table Overflow DoS | β€” | No | [EDB](https://www.exploit-db.com/exploits/41601) | All |
353
+ | EDB-28056 | ROSSSH sshd Remote Heap Corruption | β€” | No | [EDB](https://www.exploit-db.com/exploits/28056) | Multiple |
354
+ | EDB-24968 | Syslog Server Windows 1.15 BoF DoS | β€” | No | [EDB βœ“](https://www.exploit-db.com/exploits/24968) | Win app |
355
+ | EDB-18817 | Generic Router DoS | β€” | No | [EDB](https://www.exploit-db.com/exploits/18817) | Multiple |
356
+ | EDB-52366 | RouterOS 7.19.1 WebFig Reflected XSS | β€” | No | [EDB](https://www.exploit-db.com/exploits/52366) | 7.19.1 |
357
+ | EDB-48474 | Router Monitoring System 1.2.3 SQLi | β€” | No | [EDB](https://www.exploit-db.com/exploits/48474) | Web app |
358
+ | EDB-39817 | DNSmasq/Mikrotik Web Interface SQLi | β€” | No | [EDB](https://www.exploit-db.com/exploits/39817) | Web app |
359
+
360
+ > βœ“ = EDB Verified | All PoCs are detection-only β€” no destructive payloads sent.
361
+ > Full guide: [Wiki β€” EDB Exploit Coverage](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/EDB-Exploit-Coverage)
362
+
363
+ ---
364
+
365
+ ## πŸ“¦ Project Layout
366
+
367
+ ```
368
+ MikrotikAPI-BF/
369
+ β”œβ”€β”€ version.py # Canonical version source (edit to bump)
370
+ β”œβ”€β”€ mikrotikapi-bf.py # Main entry point (v3.5.4)
371
+ β”œβ”€β”€ pyproject.toml # pip package definition
372
+ β”œβ”€β”€ requirements.txt
373
+ β”œβ”€β”€ .env.example # Environment variable template (safe to commit)
374
+ β”œβ”€β”€ SECURITY.md # Vulnerability reporting policy
375
+ β”œβ”€β”€ mikrotikapi_bf/ # pip installable package
376
+ β”‚ β”œβ”€β”€ __init__.py
377
+ β”‚ └── cli.py # Entry point for `mikrotikapi-bf` command
378
+ β”œβ”€β”€ nse/ # Nmap NSE scripts (v3.5.4+)
379
+ β”‚ β”œβ”€β”€ README.md
380
+ β”‚ β”œβ”€β”€ mikrotik-api-brute.nse
381
+ β”‚ β”œβ”€β”€ mikrotik-api-info.nse
382
+ β”‚ β”œβ”€β”€ mikrotik-default-creds.nse
383
+ β”‚ β”œβ”€β”€ mikrotik-routeros-version.nse
384
+ β”‚ └── mikrotik-winbox-cve-2018-14847.nse
385
+ β”œβ”€β”€ core/ # Core engine
386
+ β”‚ β”œβ”€β”€ api.py # RouterOS binary API protocol
387
+ β”‚ β”œβ”€β”€ cli.py # CLI argument parsing
388
+ β”‚ β”œβ”€β”€ export.py # JSON/CSV/XML/TXT export
389
+ β”‚ β”œβ”€β”€ log.py # Logging subsystem
390
+ β”‚ β”œβ”€β”€ progress.py # Progress bar + ETA
391
+ β”‚ β”œβ”€β”€ retry.py # Retry + backoff
392
+ β”‚ └── session.py # Persistent session management
393
+ β”œβ”€β”€ modules/ # Feature modules
394
+ β”‚ β”œβ”€β”€ decoder.py # RouterOS file decoder: user.dat/.backup/supout.rif (v3.5.4)
395
+ β”‚ β”œβ”€β”€ discovery.py # Network discovery
396
+ β”‚ β”œβ”€β”€ fingerprint.py # Device fingerprinting (Shodan + REST)
397
+ β”‚ β”œβ”€β”€ mac_server.py # Layer-2 MNDP discovery + MAC-Telnet (v3.3.0)
398
+ β”‚ β”œβ”€β”€ proxy.py # Proxy/SOCKS5 support
399
+ β”‚ β”œβ”€β”€ reports.py # Report generation
400
+ β”‚ β”œβ”€β”€ stealth.py # Fibonacci delays + UA rotation
401
+ β”‚ └── wordlists.py # Smart wordlist engine
402
+ β”œβ”€β”€ xpl/ # Exploit/CVE engine
403
+ β”‚ β”œβ”€β”€ cve_db.py # CVE database (40 exploits)
404
+ β”‚ β”œβ”€β”€ exploits.py # 40 exploit classes
405
+ β”‚ β”œβ”€β”€ npk_decoder.py # NPK package analyzer (v3.5.4)
406
+ β”‚ β”œβ”€β”€ nvd_shodan.py # NVD API + Shodan integration
407
+ β”‚ └── scanner.py # Vulnerability scanner
408
+ β”œβ”€β”€ img/ # Attack surface diagrams
409
+ β”‚ β”œβ”€β”€ mikrotik_full_attack_surface.png
410
+ β”‚ β”œβ”€β”€ mikrotik_access_vectors.png
411
+ β”‚ └── mikrotik_access_targets.png
412
+ └── examples/
413
+ β”œβ”€β”€ example_basic.sh example_discovery.sh example_stealth.sh
414
+ └── usernames.txt passwords.txt combos.txt
415
+ ```
416
+
417
+ ---
418
+
419
+ ## 🧱 RouterOS Defenses You Will Encounter
420
+
421
+ - Session controls and server-side anti-fraud for auth flows
422
+ - Request limits and rate-limiting per source (when configured)
423
+ - Temporary account lockouts and backoff windows
424
+ - Extensive logging (auth failures, rate limiting, HTTP 4xx/5xx)
425
+ - IDS/IPS/NAC and WAF-likes in front of HTTP endpoints
426
+
427
+ > Prefer stealth mode, sensible thread counts, and authorized maintenance windows.
428
+
429
+ ---
430
+
431
+ ## πŸ›‘οΈ Defensive Mitigations for RouterOS Admins
432
+
433
+ ```routeros
434
+ # Disable unused services
435
+ /ip service disable telnet,ftp,api
436
+
437
+ # Restrict API access by source IP
438
+ /ip service set api address=10.0.0.0/8
439
+
440
+ # Disable MAC-Server (L2 exposure)
441
+ /tool mac-server set allowed-interface-list=none
442
+ /ip neighbor discovery-settings set discover-interface-list=none
443
+
444
+ # Add firewall to protect management ports
445
+ /ip firewall filter
446
+ add chain=input connection-state=established,related action=accept
447
+ add chain=input src-address=<MGMT-NET>/24 action=accept
448
+ add chain=input action=drop
449
+ ```
450
+
451
+ ---
452
+
453
+ ## πŸ“– Documentation
454
+
455
+ | Resource | Link |
456
+ |----------|------|
457
+ | **GitHub Wiki (en-US)** | [Complete Usage Guide](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/Complete-Usage-Guide) |
458
+ | **GitHub Wiki (pt-BR)** | [Guia Completo](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/Complete-Usage-Guide-pt-BR) |
459
+ | **EDB Exploit Coverage** | [Wiki β€” EDB-Exploit-Coverage](https://github.com/mrhenrike/MikrotikAPI-BF/wiki/EDB-Exploit-Coverage) |
460
+ | **NSE Scripts Guide** | [nse/README.md](nse/README.md) |
461
+ | **Security Policy** | [SECURITY.md](SECURITY.md) |
462
+ | **Changelog** | [Releases](https://github.com/mrhenrike/MikrotikAPI-BF/releases) |
463
+ | **API Reference** | [docs/API_REFERENCE.md](docs/API_REFERENCE.md) |
464
+
465
+ ---
466
+
467
+ ## πŸ“‹ What's New
468
+
469
+ ### v3.5.4 (current)
470
+ - **NSE auto-installer** β€” `mikrotikapi_bf/nse_installer.py` copies NSE scripts to Nmap on Windows/Linux/macOS automatically during `pip install` or `pip install --upgrade`
471
+ - **`--install-nse`** flag and `mikrotikapi-install-nse` entry point for manual NSE installation
472
+ - **3 more official Nmap MikroTik scripts** bundled: `mikrotik-routeros-brute.nse`, `mikrotik-routeros-username-brute.nse`, `broadcast-mndp-discover.nse`
473
+ - **300-thread support** β€” `--threads N` (up to 300) with mandatory `--high-threads` disclaimer for values > 15
474
+ - **`setup.py` post-install hook** β€” NSE scripts installed automatically on pip install
475
+ - **`pyproject.toml` fixed** β€” proper `setuptools.build_meta` backend; package builds and passes `twine check`
476
+ - **GitHub Actions** β€” `.github/workflows/publish-pypi.yml` + `publish-testpypi.yml` with OIDC trusted publishing
477
+ - **PyPI-ready** β€” `dist/mikrotikapi_bf-3.5.4-py3-none-any.whl` built and validated
478
+ - **Printer NSE scripts** β€” collected in `dev/Printers/` (12 scripts: HP, Xerox, Lexmark, CUPS, PJL, SNMP)
479
+ - **VINCE VUID 375660** β€” comprehensive technical update prepared: CVSS 9.8, CWE-307, PoC tool ref, Shodan Brazil scale (19,424 devices), expired 90-day deadline notice
480
+
481
+ ### v3.5.3
482
+ - **5 Nmap NSE scripts** in `nse/`: `mikrotik-routeros-version`, `mikrotik-api-brute`, `mikrotik-default-creds`, `mikrotik-api-info`, `mikrotik-winbox-cve-2018-14847`
483
+ - **pip install support** β€” `pyproject.toml` + `mikrotikapi_bf/` entry point package
484
+ - **`mikrotikapi-bf --nse-path`** β€” prints installed NSE scripts directory for Nmap
485
+
486
+ ### v3.5.2
487
+ - **`version.py`** β€” single source of truth for version (all modules import from here)
488
+ - **`.env.example`** β€” safe template committed; `.env` stays in `.gitignore`
489
+ - **`python-dotenv`** β€” `.env` loaded automatically at startup
490
+
491
+ ### v3.5.1
492
+ - Fix: syntax error in CVE-2025-6563 XSS payload
493
+ - Credits & Acknowledgements section (13 contributors)
494
+ - Comprehensive wiki guides en-US + pt-BR (40+ CLI flags documented)
495
+
496
+ ### v3.5.0
497
+ - `modules/decoder.py` β€” Python 3 port of [mikrotik-tools](https://github.com/0ki/mikrotik-tools): `UserDatDecoder`, `BackupDecoder`, `SupoutDecoder`, `MTDatDecoder`
498
+ - `xpl/npk_decoder.py` β€” NPK package analyzer (18 part types)
499
+ - `--target-list / -T` β€” multi-target scanning from file
500
+ - `--decode-userdat`, `--decode-backup`, `--analyze-npk`, `--decode-supout`
501
+ - 5 new CVEs: CVE-2019-3981, CVE-2020-5720, CVE-2022-45313, CVE-2017-20149, CVE-2025-6563
502
+ - **Total: 40 exploit classes** | Lab validation on RouterOS 7.20.7 β€” 8 vulnerabilities confirmed
503
+
504
+ ### v3.4.0
505
+ - 13 Exploit-DB public PoC exploits (full EDB Mikrotik list coverage)
506
+ - Complete CVE/EDB coverage table in README
507
+
508
+ ### v3.3.0
509
+ - MAC-Server / Layer-2: MNDP discovery, MAC-Telnet brute, CVE-2018-14847-MAC
510
+ - 5 new CVE exploit classes
511
+ - Attack surface diagrams (3 images)
512
+
513
+ ---
514
+
515
+ ## πŸ™ Credits & Acknowledgements
516
+
517
+ | Contributor | Contribution | Link |
518
+ |-------------|-------------|------|
519
+ | **Federico Massa & Ramiro Caire** | MKBRUTUS β€” original RouterOS API brute-force concept | [mkbrutusproject/MKBRUTUS](https://github.com/mkbrutusproject/MKBRUTUS) |
520
+ | **Kirils Solovjovs** (@KirilsSolovjovs) | mikrotik-tools: user.dat decoder, backup decoder, NPK format research β€” ported to Python 3 | [0ki/mikrotik-tools](https://github.com/0ki/mikrotik-tools) |
521
+ | **Dmitriusan** | Empty `read_sentence()` fix + socket timeout retry (issue #3) | [Dmitriusan/MikrotikAPI-BF](https://github.com/Dmitriusan/MikrotikAPI-BF) |
522
+ | **alina0x** | Multi-target scanning via `ips.txt` β†’ `--target-list / -T` | [alina0x/mikrotik-multithread-bf](https://github.com/alina0x/mikrotik-multithread-bf) |
523
+ | **rafathasan** | Autosave + session resume improvements | [rafathasan/MikrotikAPI-BF-Improved](https://github.com/rafathasan/MikrotikAPI-BF-Improved) |
524
+ | **sajadmirave** | Connection check before brute-force (PR #4) | [sajadmirave/MikrotikAPI-BF](https://github.com/sajadmirave/MikrotikAPI-BF) |
525
+ | **BasuCert** | WinboxPoC / MACServerExploit.py β€” MAC-server attack reference | [BasuCert/WinboxPoC](https://github.com/BasuCert/WinboxPoC) |
526
+ | **Jacob Baines** (Tenable) | CVE-2019-3924, CVE-2019-3943, CVE-2019-3976/3977/3978 | [tenable/routeros](https://github.com/tenable/routeros) |
527
+ | **BigNerd95 / Lorenzo Santina** | Chimay-Red Stack Clash PoC (EDB-44283/44284) | [BigNerd95/Chimay-Red](https://github.com/BigNerd95/Chimay-Red) |
528
+ | **ShadOS** | SNMP DoS + SNMP write PoC (EDB-31102, EDB-6366) | Exploit-DB |
529
+ | **FarazPajohan** | FTP/ICMP/ARP/RouterBoard DoS PoCs | Exploit-DB |
530
+ | **kingcope** | ROSSSH sshd heap corruption (EDB-28056) | Exploit-DB |
531
+ | **xis_one** | Syslog Server BoF DoS Metasploit module (EDB-24968) | Exploit-DB |
532
+ | **hyp3rlinx** | DNSmasq/Mikrotik SQL Injection (EDB-39817) | Exploit-DB |
533
+ | **Prak Sokchea** | RouterOS 7.19.1 WebFig XSS (EDB-52366) | Exploit-DB |
534
+ | **0xjpuff** | CVE-2023-30799 (FOISted) PoC reference | [0xjpuff/CVE-2023-30799](https://github.com/0xjpuff/CVE-2023-30799) |
535
+
536
+ *RouterOS ecosystem diagram adapted from Kirils Solovjovs' research β€” Balccon 2017.*
537
+
538
+ ---
539
+
540
+ ## ⚠️ Legal Notice
541
+
542
+ <!-- LEGAL-NOTICE-UG-MRH -->
543
+
544
+ - **Use** β€” For education, research, and **explicitly authorized** security testing only. Do not use against systems without formal written permission.
545
+ - **No warranty** β€” Provided **AS IS** under [MIT License](LICENSE). No fitness guarantees.
546
+ - **No liability** β€” Author(s) not liable for misuse, damages, or third-party claims. **Use at your own risk.**
547
+ - **Attribution** β€” Keep copyright notices. Pull requests and issues are welcome.
548
+
549
+ ---
550
+
551
+ ## πŸ’¬ Support
552
+
553
+ - **GitHub:** [https://github.com/mrhenrike/MikrotikAPI-BF](https://github.com/mrhenrike/MikrotikAPI-BF)
554
+ - **Issues:** [https://github.com/mrhenrike/MikrotikAPI-BF/issues](https://github.com/mrhenrike/MikrotikAPI-BF/issues)
555
+ - **Wiki:** [https://github.com/mrhenrike/MikrotikAPI-BF/wiki](https://github.com/mrhenrike/MikrotikAPI-BF/wiki)
556
+ - **Security reports:** See [SECURITY.md](SECURITY.md)
557
+
558
+ Licensed under MIT β€” see [`LICENSE`](LICENSE).
559
+