Exploitation of Critical MikroTik Vulnerability Enables Persistent Access

A recent critical vulnerability in MikroTik devices has been exploited by attackers to bypass SSH authentication, creating new accounts for persistent access. The issue has emerged as an urgent concern for organizations utilizing these devices, as attacks can ensue even post-patch if proper steps aren’t taken. The vulnerability, highlighted by ISC SANS, demonstrates how attackers are leveraging this flaw to compromise network environments.

Campaign or TTP Overview

The observed technique involved exploiting a particular vulnerability in MikroTik’s RouterOS, which allowed an attacker to bypass SSH authentication mechanisms effectively. This vulnerability was primarily utilized in campaigns targeting businesses and infrastructure reliant on MikroTik routers. Discovered and publicly acknowledged in late 2023, the vulnerability provided attackers a direct vector to create unauthorized user accounts, subsequently facilitating persistent access to the compromised devices.

Although the attack specifics remain somewhat obfuscated, affected parties have noted that a variety of industries using MikroTik devices have been targets. The exploitation allows attackers to maintain access by creating persistent accounts, which persist even if an organization attempts to patch their devices post-compromise, underscoring the significant and ongoing threat posed by these vulnerabilities.

How It Was Built

The attack leveraged a well-crafted infrastructure setup, utilizing known MikroTik exploits to gain initial access. Upon access, the delivery mechanism switched to creating unauthorized accounts through manipulated SSH sessions. The attacker’s payload was stealthy, designed to bypass existing security protocols while embedding itself deeply within the system configuration. The typical attack progression included:


1. Identification of target MikroTik devices through online scanners identifying open SSH ports.

2. Execution of SSH bypass attack to exploit the existing vulnerability.

3. Deployment of a script payload to create a new administrative account.

4. Establishment of a secure, hidden communication channel to ensure persistent access.

Sample payload extracted indicated a simple yet effective script:


/user add name=newAdmin group=full password=NewStrongPass123

/ip ssh set allow-unspecified-connections=yes

/system reboot

The script adds a new administrative user and reconfigures SSH settings to facilitate ongoing access, illustrating an efficient use of the identified vulnerability.

Why It Worked

The campaign’s success hinged on a few key tactics:

Exploitation of a disclosed, unpatched vulnerability: Despite public warnings, many devices remained unpatched, making exploitation straightforward.
Creation of persistent, stealthy accounts: The attack script ensured new accounts appeared legitimate, dodging surface-level security audits.
Minimal intrusion footprint: By relying on manipulated SSH sessions and legitimate system commands, the attackers reduced suspicion and detection rates significantly.

This method’s ingenuity lay in its straightforwardness — identifying and leveraging a single point of compromise that provided wide-reaching access and control.

Operator Takeaways

For red team practitioners, the attack provides several actionable insights worth considering:

Utilize real-world vulnerabilities: Emulating this strategy involves identifying current vulnerabilities that are publicly acknowledged but under-exploited.
Streamline payload delivery: Keep scripts minimalistic yet potent in function, similar to the MikroTik attack which managed user account manipulations efficiently.
Infrastructure identification: Use network scanning tools to identify and catalog devices susceptible to known vulnerabilities as a preparatory step.

Good / Better / Best

Good: Use known vulnerabilities to gain initial access, providing a real-world simulation scenario.
Better: Implement measures to make persistent access less detectable, including using legitimate appearances for accounts and access methods.
Best: Employ robust post-exploitation techniques, incorporating lateral movement strategies and ensuring operational security to maintain access without detection.