Attack Chain

1. The attacker performs network scanning to identify reachable Winbox services on TCP port 8291.
2. The attacker establishes an initial session with the Winbox service by sending a crafted 'FIRST_PAYLOAD'.
3. The service responds, and the attacker extracts the session ID from the 38th byte of the response.
4. The attacker injects the extracted session ID into a 'SECOND_PAYLOAD' at the 19th byte position.
5. The attacker sends this second payload to request the sensitive file '/flash/rw/store/user.dat'.
6. The service returns the file content to the attacker, including encrypted user credentials.
7. The attacker parses the data for 'M2' entries and applies XOR decryption using the MD5 hash of the username concatenated with a hardcoded salt.
8. The attacker obtains plain-text administrative credentials and gains full access to the router.

Impact

Successful exploitation results in the immediate exposure of all local administrative credentials stored on the router. Given the high-privilege nature of these accounts, attackers can gain complete control of the network device, leading to traffic interception, modification of network configuration, deployment of backdoors, or the utilization of the compromised router as an entry point for further lateral movement within the organization.

Recommendation

Prioritize patching all internet-facing or internal MikroTik RouterOS devices to the current long-term or stable release versions, specifically ensuring the system is at or above version 6.42.1 (for stable) or 6.40.8 (for long-term). Block external access to TCP port 8291 via perimeter firewalls if Winbox management is not strictly required from remote locations. Use the Sigma rule below to monitor for mass scanning or exploitation attempts targeting the Winbox service.