mirror.MikroTik/casterbyte.Sara
1
0
Fork 0
mirror of https://github.com/casterbyte/Sara.git synced 2025-06-22 22:23:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

v1.1 release 'Judge' - major improvements & fixes

Browse source
This commit is contained in:
casterbyte 2025-03-02 22:35:33 +05:00
parent 657f4e4d5f
commit 95b59a9a0c
5 changed files with 1166 additions and 528 deletions
Download patch file Download diff file Expand all files Collapse all files

453
README.md
View file

@ -1,161 +1,366 @@
# Sara: RouterOS Security Inspector (A new version is on the way) # Sara: RouterOS Security Inspector
It is a autonomous RouterOS configuration analyzer for finding security issues on MikroTik hardware. RouterOS configuration analyzer to find security misconfigurations and vulnerabilities.
![](/banner/banner.png)
``` ```
_____ RouterOS Security Inspector. For security engineers
/ ____| Operates remotely using SSH, designed to evaluate RouterOS security
| (___ __ _ _ __ __ _
\___ \ / _` | '__/ _` |
____) | (_| | | | (_| |
|_____/ \__,_|_| \__,_| v1.0
RouterOS Security Inspector. Designed for security professionals Author: Magama Bazarov, <caster@exploit.org>
Alias: Caster
Author: Magama Bazarov, <caster@exploit.org> Version: 1.1
Codename: Judge
``` ```
# Disclaimer
**Sara** is developed for security professionals to audit their own devices. **Unauthorized use may be illegal.**
The author does not take any responsibility for the misuse of this tool, including, but not limited to:
- Use for unauthorized access, hacking, or any form of cyberattack;
- Misinterpretation of results leading to undesirable configuration changes;
- Legal repercussions arising from the misuse of **Sara** for purposes other than security auditing.
# Sara is not an attack tool
**Sara does not bypass authentication, exploit vulnerabilities, or alter RouterOS configurations.** It works in **read-only mode**, requiring no administrative privileges.
If you are unsure about the interpretation of the analysis results, consult an experienced network engineer before making any decisions!
# Legal Restrictions
Before use, ensure that your device auditing complies with your organization's local laws and policies.
- You are solely responsible for your use of Sara;
- Use it only on your devices or with the owner's permission;
- Do not use Sara on other people's networks without the owner's explicit consent - this may violate computer security laws!
# Mechanism # Mechanism
This tool is written in Python 3 and uses regular expressions to look for specific values in configurations to detect a problem. As of v1.0, the tool performs 20 security checks, including: **Sara** uses [netmiko](https://github.com/ktbyers/netmiko) to remotely connect via SSH to RouterOS devices. It executes RouterOS system commands to extract configuration data and analyze it for potential vulnerabilities and signs of compromise. The user connects to the hardware himself using Sara by entering his username and password. Sara executes exactly `print` based commands, thus not changing the configuration of your hardware in any way. So, by the way, you can even use an RO-only account if you want to.
Sara does not use any exploits, payloads or bruteforce attacks. All RouterOS security analysis here is based on pure configuration analysis.
1. **SMB Service Detection**: Identifies if the SMB service is enabled, which may expose the device to vulnerabilities like CVE-2018-7445; ## What exactly is Sara checking for?
2. **RMI Services Analysis**: Examines active Remote Management Interface (RMI) services such as Telnet, FTP, SSH, and others. The tool warns about unsafe services and provides recommendations for securing them; 1. **SMB protocol activity** – determines whether SMB is enabled, which may be vulnerable to CVE-2018-7445;
3. **UPnP Status Check**: Detects if Universal Plug and Play (UPnP) is enabled, which can open up the network to unauthorized access; 2. **Check the status of RMI interfaces** – identifies active management services (Telnet, FTP, Winbox, API, HTTP/HTTPS);
4. **WiFi Configuration Review**: Analyzes WiFi settings for vulnerabilities, including insecure authentication methods, enabled WPS, and PMKID exposure;
5. **DNS Configuration Review**: Checks DNS settings, looking for remote DNS requests being allowed and the absence of DNS over HTTPS (DoH);
6. **Dynamic DNS (DDNS) Status**: Identifies if DDNS is enabled, which might expose your network to unnecessary risks;
7. **Power over Ethernet (PoE) Settings Review**: Analyzes PoE configurations to ensure power management does not pose risks to connected devices;
8. **Protected RouterBOOT Check**: Ensures that Protected RouterBOOT is enabled, preventing unauthorized changes to the bootloader settings;
9. **SOCKS Proxy Detection**: Identifies if a SOCKS proxy is enabled, which could indicate a compromised device;
10. **Bandwidth Server Check**: Detects if the Bandwidth Server is enabled, which could lead to unwanted traffic on the network;
11. **OSPF Interface Analysis**: Examines OSPF interface settings for missing passive mode and authentication, both of which are crucial for securing OSPF communications;
12. **VRRP Interface Analysis**: Checks for VRRP interfaces that lack proper authentication, potentially exposing the network to Man-in-the-Middle (MITM) attacks;
13. **Discovery Protocols Configuration**: Reviews the settings for network discovery protocols, ensuring they are limited to trusted interfaces;
14. **User Password Policy Check**: Analyzes user password policies to ensure they meet security best practices;
15. **SSH Strong Crypto Detection**: Detects if SSH is configured with weak cryptography, providing advice on how to secure it;
16. **Connection Tracking Status**: Reviews the connection tracking settings, advising on when it might be beneficial to disable it;
17. **RoMON Status Check**: Detects if RoMON is enabled, highlighting the need for careful management to prevent unauthorized access to other RouterOS devices;
18. **MAC Server Settings Review**: Analyzes MAC Server and MAC Winbox settings, recommending restrictions to enhance security;
19. **SNMP Analysis**: Identifies the use of default or weak SNMP community strings, which could lead to information gathering attacks;
20. **Port Forwarding Rules Check**: Detects port forwarding rules (dst-nat), warning about potential exposure of internal services to the internet.
# Usage 3. **Wi-Fi Security Check** – determines whether WPS and PMKID support are enabled, which can be used in WPA2-PSK attacks;
To install Sara: > At the moment, this check has minor stability issues, as different versions of RouterOS have different variations of Wi-Fi configurations. Keep that in mind, but feel free to make an issue, we'll look into it.s
4. **Check UPnP** – determines whether UPnP is enabled, which can automatically forward ports and threaten network security;
5. **Check DNS settings** – detects whether `allow-remote-requests`, which makes the router a DNS server, is enabled;
6. **Check DDNS** – determines whether dynamic DNS is enabled, which can reveal the real IP address of the device;
7. **PoE Test** – checks if PoE is enabled, which may cause damage to connected devices;
8. **Check RouterBOOT security** – determines if RouterBOOT bootloader protection is enabled;
9. **Check SOCKS Proxy** – identifies an active SOCKS Proxy that could be used by an attacker for pivoting, as well as indicating a potential compromise of the device.
10. **Bandwidth Server Test (BTest)** – determines whether a bandwidth server is enabled that can be used for a Flood attack by the attacker;
11. **Check discovery protocols** – determines whether CDP, LLDP, MNDP that can disclose network information are active;
12. **Check minimum password length** – determines whether the `minimum-password-length` parameter is set to prevent the use of weak passwords;
13. **SSH Check** – analyzes SSH settings, including the use of strong-crypto and Port Forwarding permission;
14. **Check Connection Tracking** – determines whether Connection Tracking is enabled, which can increase the load and open additional attack vectors;
15. **RoMON check** – detects RoMON activity, which allows you to manage devices at Layer 2;
16. **Check Winbox MAC Server** – analyzes access by MAC address via Winbox and Telnet, which can be a vulnerability on a local network;
17. **Check SNMP** – detects the use of weak SNMP community strings (`public`, `private`);
18. **Check NAT rules** – analyzes port forwarding (`dst-nat`, `netmap`) that may allow access to internal services from the outside;
19. **Check network access to RMI** – determines whether access to critical services (API, Winbox, SSH) is restricted to trusted IPs only;
20. **Check RouterOS version** – analyzes the current version of RouterOS and compares it to known vulnerable versions;
21. **RouterOS Vulnerability Check** – checks the RouterOS version against the CVE database and displays a list of known vulnerabilities;
22. **“Keep Password” in Winbox** – warns of potential use of the “Keep Password” feature
23. **Check default usernames** – defines the use of standard logins (`admin`, `engineer`, `test`, `mikrotik`);
24. **Checking the schedulers** – detects malicious tasks that can load remote scripts, perform hidden reboots, or run too often;
25. **Check static DNS records** – Analyzes static DNS records that can be used for phishing and MITM attacks.
## A breakdown of one technique
Sara analyzes MikroTik RouterOS configuration by sending commands via SSH and interpreting the results. Let's consider a basic example of checking an SMB service that may be vulnerable to CVE-2018-7445.
```python
# SMB Check
def check_smb(connection):
separator("Checking SMB Service")
command = "/ip smb print"
output = connection.send_command(command)
if "enabled: yes" in output:
print(Fore.RED + Style.BRIGHT + "[*] CAUTION: SMB service is enabled! Are you sure you want it? Also, avoid CVE-2018-7445")
else:
print(Fore.GREEN + "[+] SMB is disabled. No risk detected.")
print(Fore.GREEN + "[+] No issues found.")
```
1. Sending a command to the router: command = `/ip smb print` - queries the status of the SMB service;
2. `output = connection.send_command(command)` - executes the command via SSH and receives its output, writing it to the variable memory;
3. If the output contains the string `“enabled: yes”`, then SMB is enabled and the script displays a warning.
The same principle works for the other checks. Only read the configuration and then analyze it in detail.
# Vulnerability Search (CVE)
Sara performs a security analysis of RouterOS by checking the current firmware version and checking it against a database of known vulnerabilities (CVEs). This process identifies critical vulnerabilities that can be exploited by attackers to compromise the device.
## But how does it work?
1. Sara extracts the current RouterOS version from the device using the system command (`/system resource print`)
2. The check is performed using the built-in `cve_lookup.py` module, which stores a dictionary of known RouterOS vulnerabilities. This module is based on data obtained [from the MITRE CVE database](https://cve.mitre.org/data/downloads) and contains:
- CVE ID;
- Vulnerability Description;
- Range of vulnerable RouterOS versions
Sara analyzes the version of the device and determines if it falls into the list of vulnerable versions.
3. If the RouterOS version contains known vulnerabilities, Sara displays a warning indicating:
- CVE ID;
- Description of the vulnerability and potential risks.
## Specifics of checking
- Sara does not verify real-world exploitation of vulnerabilities. It only cross-references the RouterOS version against publicly available CVE databases;
- If the device is running an older version of RouterOS, but vulnerable services have been manually disabled, some warnings may be false positives;
- The CVE database is updated over time, so it is recommended to keep an eye out for current patches from MikroTik yourself.
# How to use
You have two ways to install Sara:
1. In Kali Linux:
1. Kali Linux
```bash ```bash
caster@kali:~$ sudo apt update && sudo apt install sara caster@kali:~$ sudo apt update && sudo apt install sara
caster@kali:~$ sara -h caster@kali:~$ sara -h
``` ```
2. Via Python3
2. Manually using Git and Python:
```bash ```bash
caster@kali:~$ sudo apt install python3-colorama git ~$ sudo apt install git python3-colorama python3-netmiko python3-packaging
caster@kali:~$ git clone https://github.com/casterbyte/Sara ~$ git clone https://github.com/casterbyte/Sara
caster@kali:~/Sara$ sudo python3 setup.py install ~$ cd Sara
caster@kali:~$ sara ~/Sara$ sudo python3 setup.py install
~$ sara -h
```
## Trigger Arguments (CLI Options)
Sara supports the following command line options:
```bash
usage: sara.py [-h] --ip IP --username USERNAME --password PASSWORD [--port PORT]
options:
-h, --help show this help message and exit
--ip IP The address of your MikroTik router
--username USERNAME SSH username (RO account can be used)
--password PASSWORD SSH password
--port PORT SSH port (default: 22)
```
1. `--ip` - this argument specifies the IP address of the MikroTik device to which Sara is connecting;
2. `--username` - the SSH username that will be used to connect. Sara supports only authorized access;
> You can use read-only (RO) accounts. Sara does not make configuration changes, so you do not need `write` or `full` level access.
3. `--password` - password for SSH authentication;
4. `--port` - allows you to specify a non-standard SSH port for connection. The default is **22**, but if you have changed the SSH port number, it must be specified manually.
# Sara's Launch
```bash
caster@kali:~$ python3 sara.py --ip 192.168.88.1 --username admin --password mypass
_____ _____
/ ____| / ____|
| (___ __ _ _ __ __ _ | (___ __ _ _ __ __ _
\___ \ / _` | '__/ _` | \___ \ / _` | '__/ _` |
____) | (_| | | | (_| | ____) | (_| | | | (_| |
|_____/ \__,_|_| \__,_| v1.0 |_____/ \__,_|_| \__,_|
RouterOS Security Inspector. Designed for security professionals RouterOS Security Inspector. For security engineers
Operates remotely using SSH, designed to evaluate RouterOS security
Author: Magama Bazarov, <caster@exploit.org> Author: Magama Bazarov, <caster@exploit.org>
Alias: Caster
Version: 1.1
Codename: Judge
Documentation & Usage: https://github.com/casterbyte/Sara
It's recommended to provide a configuration file exported using the 'export verbose' command [!] DISCLAIMER: Use this tool only for auditing your own devices.
[!] Unauthorized use on third-party systems is ILLEGAL.
[!] The author is not responsible for misuse.
usage: sara [-h] --config-file CONFIG_FILE WARNING: This tool is for security auditing of YOUR OWN RouterOS devices.
sara: error: the following arguments are required: --config-file Unauthorized use may be illegal. Proceed responsibly.
Do you wish to proceed? [yes/no]: yes
[*] Connecting to RouterOS at 192.168.88.1:22
[*] Connection successful!
========================================
[*] Checking RouterOS Version
[+] Detected RouterOS Version: 7.15.3
[+] No known CVEs found for this version.
========================================
[*] Checking SMB Service
[+] SMB is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking RMI Services
[!] ALERT: TELNET is ENABLED! This is a high security risk.
- Account passwords can be intercepted
[!] ALERT: FTP is ENABLED! This is a high security risk.
- Are you sure you need FTP?
[!] ALERT: HTTP is ENABLED! This is a high security risk.
- Account passwords can be intercepted
[+] OK: SSH is enabled. Good!
- Are you using strong passwords and SSH keys for authentication?
[!] CAUTION: HTTP-SSL is enabled.
- HTTPS detected. Ensure it uses a valid certificate and strong encryption.
[!] CAUTION: API is enabled.
- RouterOS API is vulnerable to a bruteforce attack. If you need it, make sure you have access to it.
[!] CAUTION: WINBOX is enabled.
[!] CAUTION: If you're using 'Keep Password' in Winbox, your credentials may be stored in plaintext!
- If your PC is compromised, attackers can extract saved credentials.
- Consider disabling 'Keep Password' to improve security.
[!] CAUTION: API-SSL is enabled.
- RouterOS API is vulnerable to a bruteforce attack. If you need it, make sure you have access to it.
========================================
[*] Checking Default Usernames
[!] CAUTION: Default username 'admin' detected! Change it to a unique one.
[!] CAUTION: Default username 'engineer' detected! Change it to a unique one.
========================================
[*] Checking network access to RMI
[!] CAUTION: TELNET has no IP restriction set! Please restrict access.
[!] CAUTION: FTP has no IP restriction set! Please restrict access.
[!] CAUTION: WWW has no IP restriction set! Please restrict access.
[+] OK! SSH is restricted to: 192.168.88.0/24
[!] CAUTION: WWW-SSL has no IP restriction set! Please restrict access.
[!] CAUTION: API has no IP restriction set! Please restrict access.
[+] OK! WINBOX is restricted to: 192.168.88.0/24
[!] CAUTION: API-SSL has no IP restriction set! Please restrict access.
========================================
[*] Checking Wi-Fi Security
[+] All Wi-Fi interfaces and security profiles have secure settings.
[*] If you use WPA-PSK or WPA2-PSK, take care of password strength. So that the handshake cannot be easily brute-forced.
[+] No issues found.
========================================
[*] Checking UPnP Status
[+] UPnP is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking DNS Settings
[!] CAUTION: Router is acting as a DNS server! This is just a warning. The DNS port on your RouterOS should not be on the external interface.
========================================
[*] Checking DDNS Settings
[+] DDNS is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking PoE Status
[!] CAUTION: PoE is enabled on ether1. Ensure that connected devices support PoE to prevent damage.
========================================
[*] Checking RouterBOOT Protection
[!] CAUTION: RouterBOOT protection is disabled! This can allow unauthorized firmware changes and password resets via Netinstall.
========================================
[*] Checking SOCKS Proxy Status
[+] SOCKS proxy is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking Bandwidth Server Status
[+] Bandwidth server is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking Neighbor Discovery Protocols
[+] No security risks found in Neighbor Discovery Protocol settings.
[+] No issues found.
========================================
[*] Checking Password Policy
[!] CAUTION: No minimum password length is enforced! The length of the created passwords must be taken into account.
========================================
[*] Checking SSH Security
[!] CAUTION: SSH Dynamic Port Forwarding is enabled! This could indicate a RouterOS compromise, and SSH DPF could also be used by an attacker as a pivoting technique.
[!] CAUTION: strong-crypto is disabled! It is recommended to enable it to enhance security. This will:
- Use stronger encryption, HMAC algorithms, and larger DH primes;
- Prefer 256-bit encryption, disable null encryption, prefer SHA-256;
- Disable MD5, use 2048-bit prime for Diffie-Hellman exchange;
========================================
[*] Checking Connection Tracking
[+] Connection Tracking is properly configured.
[+] No issues found.
========================================
[*] Checking RoMON Status
[+] RoMON is disabled. No risk detected.
[+] No issues found.
========================================
[*] Checking Winbox MAC Server Settings
[+] MAC Winbox are properly restricted.
[+] MAC Telnet are properly restricted.
[+] MAC Ping are properly restricted.
========================================
[*] Checking SNMP Community Strings
[+] SNMP community strings checked. No weak values detected.
[+] No issues found.
========================================
[*] Checking Firewall NAT Rules
[+] No Destination NAT (dst-nat/netmap) rules detected. No risks found.
[+] No issues found.
========================================
[*] Checking for Malicious Schedulers
[*] Checking: 'Unknown' →
[+] No malicious schedulers detected.
========================================
[*] Checking Static DNS Entries
[!] WARNING: The following static DNS entries exist:
- dc01.myownsummer.org → 192.168.88.71
- fake.example.com → 192.168.88.100
[*] Were you the one who created those static DNS records? Make sure.
[*] Attackers during RouterOS post-exploitation like to tamper with DNS record settings, for example, for phishing purposes.
========================================
[*] Checking Router Uptime
[*] Router Uptime: 64 days, 2 hours, 23 minutes
[*] Disconnected from RouterOS (192.168.88.1:22)
[*] All checks have been completed. Security inspection completed in 3.03 seconds
[*] Remember: Security is a process, not a state.
``` ```
Sara uses just one argument, it is the name/path to the RouterOS configuration file. The tool supports `.rsc` files. # Copyright
# Work Example Copyright (c) 2025 Magama Bazarov. This project is licensed under the Apache 2.0 License
```bash
caster@kali:~$ sara --config-file routeros.rsc
_____
/ ____|
| (___ __ _ _ __ __ _
\___ \ / _` | '__/ _` |
____) | (_| | | | (_| |
|_____/ \__,_|_| \__,_| v1.0
RouterOS Security Inspector. Designed for security professionals
Author: Magama Bazarov, <caster@exploit.org>
It's recommended to provide a configuration file exported using the 'export verbose' command
[*] Analyzing the configuration file: forsara.rsc (34.53 KB)
[+] Device Information
[*] RouterOS Version: X.XX.X
[*] Model: XXXX-XXXXXXXXXX
[*] Serial Number: XXXXXXXXXXX
[+] Checking RMI Services
[!] Warning: The following RMI services are enabled and may be unsafe: telnet, ftp, www.
[!] Caution: The following RMI services are enabled: ssh, www-ssl, winbox.
[!] Note: The following RMI services are enabled and might be susceptible to brute force attacks: api, api-ssl.
[*] Solution: Disable the above RMI services if they are not required for security.
[*] Tip: Restrict access to enabled services to trusted subnets only.
[+] Checking UPnP
[!] Warning: UPnP is enabled. This can expose your network to various security risks, including unauthorized access.
[*] Solution: Disable UPnP unless absolutely necessary, and ensure your firewall is properly configured.
[+] Checking WiFi Settings
[!] Warning: WPS is enabled on interface wifi1. WPS Pin code can be cracked, brute-forced.
[!] Warning: PMKID is enabled on interface wifi1. PMKID is easy to bruteforce.
[!] Warning: Interface wifi1 is using insecure authentication method 'wpa2-psk'. WPA/WPA2-PSK are long gone, use WPA2-E, WPA3.
[+] Checking DNS Settings
[!] Warning: Router is configured to allow remote DNS requests. Close the DNS UDP/53 port from the Internet.
[!] Note: DNS over HTTPS (DoH) is not configured. Consider configuring a DoH server for improved privacy.
[+] Checking PoE Settings
[!] Warning: PoE is enabled on interface ether1 with setting 'auto-on'. This could supply power to connected devices and potentially damage them if not properly managed.
[+] Checking Protected RouterBOOT
[!] Warning: Protected RouterBOOT is disabled. This may allow unauthorized changes to the bootloader settings.
[*] Solution: Enable Protected RouterBOOT to prevent unauthorized access to the bootloader.
[+] Checking SOCKS Proxy
[!] Warning: SOCKS Proxy is enabled. The presence of SOCKS may indicate that the device has been compromised.
[*] Solution: Disable SOCKS Proxy if it is not required.
[+] Checking User Password Policies
[!] Warning: Password policies are not properly configured. Both minimum password categories and minimum password length are set to 0.
[*] Solution: Set a higher minimum password length and require at least one or more character categories (e.g., uppercase, lowercase, numbers, special characters) for better security.
[+] Checking Connection Tracking
[!] Connection Tracking is currently set to 'auto'.
[*] Advice: If this device is being used as a transit router, you might consider disabling Connection Tracking to improve performance. However, proceed with caution as it can affect certain network features.
[+] Checking MAC Server Settings
[!] Warning: MAC Server is allowed on all interfaces (allowed-interface-list=all). This compromises the security of the Winbox interface.
[!] Warning: MAC Winbox is allowed on all interfaces (allowed-interface-list=all). This compromises the security of the Winbox interface.
[!] Warning: MAC Ping is enabled. Possible unwanted traffic.
[*] Solution: Limit MAC server and MAC Winbox to specific trusted interfaces, and disable MAC Ping if it is not required.
[+] Checking SNMP Communities
[!] Warning: SNMP community 'public' is in use. Possible Information Gathering attack vector by bruteforcing community string.
[!] Warning: SNMP community 'private' is in use. Possible Information Gathering attack vector by bruteforcing community string.
[*] Solution: Change the SNMP community names to something more secure, and restrict SNMP access to trusted IP addresses only.
```
# Outro # Outro
Tool will be maintained and updated, suggestions: caster@exploit.org MikroTik devices are widely used around the world. Sara is designed to help engineers improve security - use it wisely.
E-mail for contact: caster@exploit.org

BIN
banner/banner.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 18 KiB

68
cve_lookup.py Normal file
View file

@ -0,0 +1,68 @@
# Sara's helper module for CVE search based on RouterOS version analysis
# Downloaded and adapted from: https://cve.mitre.org/data/downloads
# The CVE search thanks to this module is passive and does not involve sending various payloads, launching exploits and so on
cve_routeros_database = {
"CVE-2008-0680": "SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP SET request.",
"CVE-2008-6976": "MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.",
"CVE-2012-6050": "The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll",
"CVE-2015-2350": "Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.",
"CVE-2017-17537": "MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data that begins with many '\0' characters",
"CVE-2017-17538": "MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.",
"CVE-2017-6297": "The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret",
"CVE-2017-6444": "The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection",
"CVE-2017-7285": "A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets",
"CVE-2017-8338": "A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec)",
"CVE-2018-10066": "An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network",
"CVE-2018-10070": "A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters",
"CVE-2018-1157": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.",
"CVE-2018-1158": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.",
"CVE-2018-14847": "MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.",
"CVE-2018-7445": "A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place",
"CVE-2019-13074": "A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.",
"CVE-2019-15055": "MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication",
"CVE-2019-16160": "An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.",
"CVE-2019-3924": "MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.",
"CVE-2019-3943": "MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk)",
"CVE-2019-3978": "RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning",
"CVE-2019-3981": "MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.",
"CVE-2020-10364": "The SSH daemon on MikroTik routers through 6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management",
"CVE-2020-11881": "An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets,",
"CVE-2020-20021": "An issue discovered in MikroTik Router 6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.",
"CVE-2020-20214": "MikroTik RouterOS 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.",
"CVE-2020-20217": "MikroTik RouterOS before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.",
"CVE-2020-20220": "MikroTik RouterOS prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).",
"CVE-2020-20222": "MikroTik RouterOS 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).",
"CVE-2020-20225": "MikroTik RouterOS before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.",
"CVE-2020-20227": "MikroTik RouterOS stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.",
"CVE-2020-20230": "MikroTik RouterOS before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.",
"CVE-2020-20231": "MikroTik RouterOS through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).",
"CVE-2020-20236": "MikroTik RouterOS 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.",
"CVE-2020-20237": "Mikrotik RouterOS 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.",
"CVE-2020-20245": "Mikrotik RouterOS stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.",
"CVE-2020-20246": "Mikrotik RouterOS stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.",
"CVE-2020-20248": "Mikrotik RouterOS before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.",
"CVE-2020-20249": "Mikrotik RouterOS before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet",
"CVE-2020-20250": "Mikrotik RouterOS before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference) NOTE: this is different from CVE-2020-20253 and CVE-2020-20254. All four vulnerabilities in the /nova/bin/lcdstat process are discussed in the CVE-2020-20250",
"CVE-2020-20252": "Mikrotik RouterOS before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference)",
"CVE-2020-20253": "Mikrotik RouterOS before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.",
"CVE-2020-20254": "Mikrotik RouterOS before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).",
"CVE-2020-20262": "Mikrotik RouterOS before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.",
"CVE-2020-20264": "Mikrotik RouterOS before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.",
"CVE-2020-20265": "Mikrotik RouterOS before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial of Service due via a crafted packet.",
"CVE-2020-20266": "Mikrotik RouterOS before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).",
"CVE-2020-5720": "MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack.",
"CVE-2020-5721": "MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and",
"CVE-2021-27221": "MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work.",
"CVE-2021-3014": "MikroTik RouterOS through 6.48 is vulnerable to XSS in the hotspot login page via the target parameter",
"CVE-2021-36613": "MikroTik RouterOS before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference)",
"CVE-2021-36614": "MikroTik RouterOS before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference)",
"CVE-2022-34960": "The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links",
"CVE-2022-36522": "Mikrotik RouterOS through stable 6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.",
"CVE-2022-45313": "Mikrotik RouterOS before stable 7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.",
"CVE-2022-45315": "Mikrotik RouterOS before stable 7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows attackers to execute arbitrary code via a crafted packet.",
"CVE-2023-24094": "An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.",
"CVE-2023-30799": "MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.",
"CVE-2023-30800": "The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result",
"CVE-2023-41570": "MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.",
}

1160
sara.py
View file

File diff suppressed because it is too large Load diff

9
setup.py
View file

@ -2,8 +2,8 @@ from setuptools import setup, find_packages
setup( setup(
name="sara", name="sara",
version="1.0", version="1.1",
url="https://github.com/casterbyte/sara", url="https://github.com/casterbyte/Sara",
author="Magama Bazarov", author="Magama Bazarov",
author_email="caster@exploit.org", author_email="caster@exploit.org",
scripts=['sara.py'], scripts=['sara.py'],
@ -11,11 +11,14 @@ setup(
long_description=open('README.md').read(), long_description=open('README.md').read(),
long_description_content_type='text/markdown', long_description_content_type='text/markdown',
license="Apache-2.0", license="Apache-2.0",
keywords=['mikrotik', 'routeros', 'config analyzer'], keywords=['mikrotik', 'routeros', 'config analyzer', 'network security',],
packages=find_packages(), packages=find_packages(),
install_requires=[ install_requires=[
'colorama', 'colorama',
'netmiko',
'packaging',
], ],
py_modules=['cve_lookup'],
entry_points={ entry_points={
"console_scripts": ["sara = sara:main"], "console_scripts": ["sara = sara:main"],
}, },