Exploit for Improper Enforcement of Behavioral Workflow in Mikrotik Routeros

This repository contains proof-of-concept (PoC) scripts for several MikroTik RouterOS security issues that were researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is not a production application, not a general-purpose tool, and not intended for use against systems without explicit authorization.

- Unauthenticated SSH session policy-mask swap / full-admin takeover path

- SSH public-key authentication bypass PoC for affected RouterOS builds

- Includes its helper component for signature forgery

│ └── .venv/ # Local environment; typically excluded from Git

- Understanding disclosed vulnerabilities in a controlled setting

This repository must not be used against public or third-party infrastructure without proper authorization and legal review.

The scripts are Python-based and require:

Display the built-in help and options of the script:

python3 CVE-2026-67276/CVE-2026-67276.py --help

Run the script in an authorized lab environment:

python3 CVE-2026-67276/CVE-2026-67276.py --host --user

- These scripts are proof-of-concept implementations and may not be production-safe.

- The behavior can vary depending on the RouterOS version, configuration, and environment.

- Some scripts rely on helper files stored in the same directory or in the PYTHONPATH.

- The repository is intentionally minimal and focuses on reproducibility in lab environments.

Use this repository responsibly and only in accordance with applicable laws, policies, and contractual obligations. It is the user’s responsibility to ensure that all testing is authorized and isolated from production systems.

This project is provided for educational and research purposes only. The authors do not condone unauthorized access or malicious use. All use must be limited to environments you own, operate, or are explicitly authorized to test in.

This project was created for research and defensive learning purposes, with code related to public disclosure research regarding MikroTik RouterOS vulnerabilities.

### Distribution Image Instructions (Chinese)

This repository serves as a distribution image for the **MikroTrick (MikroTik RouterOS SSH unauthenticated takeover chain**) vulnerability PoC. For detailed instructions, see the original README file in the upstream repository. The content comes from the upstream publicly available PoC repository and is used solely for archiving and distribution purposes. This PoC is intended only for security research, vulnerability validation, and authorized testing. Do not use it for unauthorized targets.

**MikroTrick** is an unauthenticated RouterOS takeover chain disclosed by CERT Polska on September 5, 2026. It consists of two flaws:

- **CVE-2026-67279** (CWE-841): SSH accepts rekeys from clients before user authentication. This allows unauthenticated clients to open session channels and send exec requests.

- **CVE-2026-86060** (CWE-88): Injection of SSH login path parameters. A username starting with a special character (observed as `-2`) is treated by the login helper as a syntax for “reading trusted identities from file descriptors”, thereby replacing the session policy mask with full administrator privileges.

**Affected versions**: `[7.24, 7.24.2)`, `[7.0.0, 7.23.4)`, `[6.0.0, 6.49.21〕`

**Fixed versions**: 7.24.2 (Stable), 7.23.4 (Long-term), 6.49.21 (Long-term), 7.25beta3

**Exploitation conditions**: SSH port is accessible (not open by default; usually manually opened by administrators).

**Off-the-shelf exploitation**: Confirmed since September 2, 2026; included in CISA KEV.

**Public PoC**: This repository contains the PoC for **CVE-2026-67276** (SSH public key authentication bypass, e=1 forged) along with the forged auxiliary script. This vulnerability is another potential entry point for MikroTrick.

CVE-2026-86060.py —— Full PoC (Unauthenticated policy mask replacement → Full administrator privileges)

├── CVE-2026-67276.py —— SSH public key authentication bypass PoC

└── forge_67276.py —— Public key/signature forgery auxiliary

- **Dependencies**: Python 3 + `paramiko` (`python3 -m pip install paramiko`)

- **Target**: Authorized/lab environment with RouterOS. The scripts are designed for lab clients; unauthorized targets are not allowed.

python3 CVE-2026-67276/CVE-2026-67276.py --help

python3 CVE-2026-67276/CVE-2026-67276.py --host --user

⚠️ The scripts create/manipulate accounts on the target device (CVE-2026-86060 path). Please run these scripts only in a **authorized and disposable** lab environment.

### Detection and Troubleshooting (Refer to Public Disclosures)

- After updates, the new RouterOS will scan for tampering traces during startup and mark them as **Flagged** (`/system/device-mode/print`).

- Key log entries: `login failure for user -2 from via ssh`, `user added by ssh:-2@`.

- Check for high-privilege users (e.g., `ops`), scripts, scheduled tasks, proxies, and tunnels. Note that Flagged entries only cover partial traces; unmarked entries do not mean clean.

This PoC is intended only for teaching, security research, and authorized testing purposes. It can only be run on devices owned by the user or with explicit authorization. Exploitation may result in executing commands with maximum privileges and creating persistent accounts. Please test in a disposable lab environment.

- **Upstream PoC author**: **Gagaltotal666 / GhostGTR666** (Public PoC repository CVE-2026-mikrotik-poc).

- **Vulnerability disclosure**: **CERT Polska**; **Reproduction analysis**: **Bishop Fox**; **Company announcement**: **MikroTik**.

- The distribution repository uses **MIT License** (see `LICENSE`).

- CERT Polska announcement:

- CERT Polska alert:

- MikroTik official security announcement:

- Bishop Fox technical analysis:

- NVD: