Exploit for Improper Enforcement of Behavioral Workflow in Mikrotik Routeros

# CVE-2026-67279 + CVE-2026-86060 - MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover

[![Python](

[![CVSS](

[![License](

[![Educational](

> **Pre-Auth SSH Takeover | Policy Mask Swap | Full-Admin Shell | Red-Blue Team Security Research Tool**

**CVE-2026-67279** and **CVE-2026-86060** form the "MikroTrick" chain — an unauthenticated SSH takeover of **MikroTik RouterOS**. CVE-2026-67279 is a state-machine flaw where a pre-auth rekey request makes the server skip the authentication gate. CVE-2026-86060 is an argument-injection bug in the login helper that treats a `-2` username as "read identity and policy mask from fd 2", letting an attacker write a full-admin policy frame into the PTY.

The chain is actively exploited in the wild since **2026-09-02**. Shadowserver observed **122,500+** internet-exposed RouterOS SSH instances. CISA added CVE-2026-86060 to the KEV catalog on **2026-09-10**.

This repository ships **two separate tools**: a weaponized **`exploit.py`** for authorized red-team operations, and a non-intrusive **`safedetect.py`** for blue teams and security audits.

Both tools are provided for **authorized security research and educational purposes only.**

| [+] **Pre-Auth Rekey Bypass** | CVE-2026-67279 — rekey before auth drops the server-side authentication gate |

| [+] **FD-2 Policy Swap** | CVE-2026-86060 — writes identity + full policy mask into the PTY, console comes up as admin |

| [+] **Full-Admin Shell** | Interactive RouterOS console without credentials |

| [+] **Account Plant** | Creates a durable full-privilege account (`hacker:hacker` by default) for stable re-login |

| [+] **Standalone RSA Forge** | Optional `--rsa-forge` mode for CVE-2026-67276 (independent vector, requires victim RSA modulus) |

| [+] **Mass Scanning** | CIDR, port ranges, file-based targets, multi-threaded |

| [+] **Proxy / Tor** | SOCKS5 / SOCKS4 / HTTP proxy support on every stage of the chain |

| [+] **Stealth Mode** | Jitter + rate limiting + connection pool to reduce detection |

| [+] **JSON / CSV / HTML Reports** | SIEM-friendly structured output |

| [+] **SafeDetect** | Non-intrusive banner + version scanner for blue teams |

| [+] **IoC Guidance** | Recommendations and known attacker IPs surfaced in every report |

| [+] **Thread-Safe** | Bounded pool, granular timeouts, per-stage error handling |

| 6.49.21 / 7.23.4 / 7.24.2 / 7.25beta3+ | [-] No |

**Patch:** Upgrade to **6.49.21**, **7.23.4**, **7.24.2**, or **7.25beta3** or newer.

git clone

python3 exploit.py --target 192.168.88.1 --plant

python3 exploit.py --target 192.168.88.1 --exec '/system resource print'

python3 exploit.py --target 10.0.0.0/24 --threads 20 --plant --output results.json

#Standalone RSA forge (CVE-2026-67276) with victim public key

python3 exploit.py --target 192.168.88.1 --rsa-forge --rsa-user admin --pubkey victim.pub --exec 'id'

python3 exploit.py --target 192.168.88.1 --tor --stealth --plant

python3 safedetect.py --target 192.168.88.1

python3 safedetect.py --target 192.168.88.0/24 --output audit.json

python3 safedetect.py --file targets.txt --threads 32 --output audit.html

| Argument | Short | Default | Description |

|----------|-------|---------|-------------|

| `--target` | - | None | Target IP or CIDR |

| `--file` | - | None | File with targets |

| `--exec` | - | None | Command to run after takeover |

| `--shell` | - | False | Interactive shell |

| `--plant` | - | False | Plant full-privilege account |

| `--plant-user` | - | hacker | Planted account name |

| `--plant-pass` | - | hacker | Planted account password |

| `--rsa-forge` | - | False | Use standalone CVE-2026-67276 RSA forgery vector |

| `--rsa-user` | - | None | Target user for RSA forgery |

| `--pubkey` | - | None | Victim OpenSSH RSA public key |

| `--modulus-hex` | - | None | Victim RSA modulus as hex |

| `--algos` | - | ssh-rsa,rsa-sha2-256 | Signature algorithms |

| `--threads` | - | 10 | Concurrent workers |

| `--timeout` | - | 12.0 | Per-connection timeout |

| `--rate-limit` | - | 0.0 | Max connections per second |

| `--pool-size` | - | 32 | Connection pool size |

| `--proxy` | - | None | Proxy URL (socks5://, socks4://, |

| `--stealth` | - | False | Enable jitter stealth |

| `--stealth-delay` | - | 0.05,0.75 | Stealth delay range |

| `--output` | - | None | Report path (.json / .csv / .html) |

| `--force` | - | False | Ignore version check |

| `-v, --verbose` | `-v` | False | Verbose output |

| Argument | Short | Default | Description |

|----------|-------|---------|-------------|

| `--target` | - | None | Target IP or CIDR |

| `--file` | - | None | File with targets |

| `--threads` | - | 20 | Concurrent workers |

| `--timeout` | - | 10.0 | Per-connection timeout |

| `--rate-limit` | - | 0.0 | Max connections per second |

| `--pool-size` | - | 64 | Connection pool size |

| `--stealth` | - | False | Enable jitter stealth |

| `--stealth-delay` | - | 0.05,0.75 | Stealth delay range |

| `--output` | - | None | Report path (.json / .csv / .html) |

| `-v, --verbose` | `-v` | False | Verbose output |

- **Only use these tools on systems you own or have explicit written permission to test.**

- Unauthorized access to network devices, routers, or any computer system is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**

- Intercepting, probing, or exploiting RouterOS devices without authorization is a criminal offense in most jurisdictions.

- The author is not responsible for any misuse, damage, or legal consequences resulting from the use of these tools.

- Always follow your country's laws and regulations.

- [CVE-2026-0073](

- [CVE-2026-54121](

- [CVE-2026-82329](