{"action":"closed","issue":{"url":"https://api.github.com/repos/0ki/mikrotik-tools/issues/6","repository_url":"https://api.github.com/repos/0ki/mikrotik-tools","labels_url":"https://api.github.com/repos/0ki/mikrotik-tools/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/0ki/mikrotik-tools/issues/6/comments","events_url":"https://api.github.com/repos/0ki/mikrotik-tools/issues/6/events","html_url":"https://github.com/0ki/mikrotik-tools/issues/6","id":324661091,"number":6,"title":"documenting attempts against v6.42.2","user":{"login":"tkellen","id":1004324,"avatar_url":"https://avatars3.githubusercontent.com/u/1004324?v=4","gravatar_id":"","url":"https://api.github.com/users/tkellen","html_url":"https://github.com/tkellen","followers_url":"https://api.github.com/users/tkellen/followers","following_url":"https://api.github.com/users/tkellen/following{/other_user}","gists_url":"https://api.github.com/users/tkellen/gists{/gist_id}","starred_url":"https://api.github.com/users/tkellen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tkellen/subscriptions","organizations_url":"https://api.github.com/users/tkellen/orgs","repos_url":"https://api.github.com/users/tkellen/repos","events_url":"https://api.github.com/users/tkellen/events{/privacy}","received_events_url":"https://api.github.com/users/tkellen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2018-05-19T21:16:32Z","updated_at":"2018-05-28T19:01:41Z","closed_at":"2018-05-28T19:01:40Z","author_association":"NONE","body":"Device: [Mikrotik hEX RB750gr3](https://www.amazon.com/gp/product/B01MSUMVUB)\r\nFirmware: 6.42.2\r\n\r\nReproduction from a fresh clone of this repo, under the `exploit-backup` folder:\r\n```shell\r\nssh admin@192.168.88.1 '/system backup save name=jailbreak dont-encrypt=yes'\r\nConfiguration backup saved\r\nscp admin@192.168.88.1:/jailbreak.backup ./jailbreak.backup\r\njailbreak.backup                                                                                                                                             100%   17KB   3.5MB/s   00:00    \r\n./exploit_b.py jailbreak.backup\r\nDone. Now restore from jailbreak.backup.\r\n\r\nscp admin@192.168.88.1:/jailbreak.backup ./jailbreak.backup\r\njailbreak.backup                                                                                                                                             100%   17KB   3.7MB/s   00:00    \r\nssh admin@192.168.88.1 '/system backup load name=jailbreak password=\"\"'\r\nSystem configuration restored, rebooting now\r\n```\r\n\r\nAfter reboot:\r\n```\r\n➜ telnet 192.168.88.1\r\nTrying 192.168.88.1...\r\nConnected to 192.168.88.1.\r\nEscape character is '^]'.\r\n\r\nMikroTik v6.42.2 (stable)\r\nLogin: devel\r\nPassword: \r\nLogin failed, incorrect username or password\r\n```\r\n\r\nReading #2 it seems like the file `pckg/option` needs to exist (is that a typo for `pkg/option`)?\r\n\r\nTried to add thusly:\r\n```\r\n➜ sftp admin@192.168.88.1 <<END\r\nmkdir pckg\r\nmkdir pckg/option\r\nEND\r\nConnected to admin@192.168.88.1.\r\nsftp> mkdir pckg\r\nsftp> mkdir pckg/option\r\n```\r\n\r\nSame behavior following:\r\n```\r\n➜ telnet 192.168.88.1\r\nTrying 192.168.88.1...\r\nConnected to 192.168.88.1.\r\nEscape character is '^]'.\r\n\r\nMikroTik v6.42.2 (stable)\r\nLogin: devel\r\nPassword: \r\nLogin failed, incorrect username or password\r\n```\r\n\r\nJust noticed the code in the VirtualBox appliance is totally different than what is in the source tree here. Tried it out. It correctly detects my device IP, plays some tones, instructs me to swap cables and then hangs on waiting for device to boot (it does reboot).\r\n\r\nAny suggestions on a path forward @0ki? I'm going to start digging into the code for the exploit in the appliance tomorrow to see if I can understand why it is getting hung up.\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"tkellen"}}