It can be used by MikroTik distributors, ISPs or any other companies who need to apply RouterOS configuration to many routers in the shortest possible time.įlashfig applies MikroTik RouterOS configuration to any RouterBOARD within 3 seconds. 3.2 Flashfig can not find router is not appliedįlashfig is an application for mass router configuration.3.1 Flashfig Configuration is not applied.

But Shodan does have a lot of results from MikroTik routers that have exposed their SNMP interface to the internet.

Unfortunately, the Winbox interface doesn’t share the platform’s hardware without authentication. With that in mind, I sought to figure out what type of MikroTik devices I had actually scanned. I expect a professional, full time administrator to be maintaining the CCR while the RB750Gr3, like most home routers, probably sees little to no maintenance. The rack mounted CCR10172–1G-8S+ with it’s 72 cores and advertised 80 Gbps throughput has a very different use case than a tiny dual core RB750Gr3. Regardless, I guess I can’t expect uniform patch cycles for all MikroTik routers since the models vary so much. Perhaps that just speaks to the level of sophistication of spray and pray attackers? Or perhaps stage 2 of the attack is meant to happen later. The following chart shows how many routers were upgraded to the latest versions of RouterOS.ĬVE-2018–14847 in the wild vs my published version.įull control of the device is possible via the Winbox port, yet attackers are just grabbing our honeypot’s admin credentials and moving on. Administrators had more than a month to upgrade to these versions before I started my scan. On Patchingĭuring the scan period, the most recent MikroTik RouterOS versions were 6.45.7 (Stable) and 6.44.6 (Long-term). The scanner extracted RouterOS versions from all 578,456 routers so I have the unique opportunity to opine on the patching habits of RouterOS administrators. Due to time constraints and lack of infrastructure, I only scanned addresses found in March 2019 port 8291 TCP scan and addresses gathered from various MikroTik-centric Shodan queries ( FTP, SNMP, HTTP, HTTP Proxy, Telnet, and PPTP). The scan total, 578,456, should be considered a floor, because I didn’t scan the entire internet. The scan found 578,456 MikroTik routers with port 8291 open to the internet. The port 8291 scan ran from Novemthrough December 2, 2019.

Hack mikrotik routeros cli