# MikroTrick: Inside the RouterOS Takeover Chain

Unauthenticated SSH rekey bypass plus username '-2' fd-injection in RouterOS login helper let attackers gain full admin on MikroTik routers.

- Payout: Real-world hack
- Severity: critical
- Program: MikroTik RouterOS
- Found by (vendor credit): Sławomir Rozbicki (CERT.PL)
- Disclosed: 2026-09-17
- CVE: CVE-2026-67279, CVE-2026-86060
- Write-up quality: 9/10
- Original: https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain
- Tags: area:devices domain:network impact:ato impact:internal-access impact:rce kind:incident platform:research sev:critical tech:linux technique:chained technique:source-review vuln:access-control vuln:auth-bypass

**Target:** RouterOS SSH service and login helper
**Root cause:** Rekeying moves an unauthenticated SSH connection past the auth-state check into the connection dispatcher, and the login helper treats a leading-dash username as a file-descriptor selector, reading a trusted identity record from the client's terminal (fd 2).
**Steps:**
1. Connect to RouterOS SSH and complete key exchange without authenticating.
2. Request an SSH rekey; on vulnerable builds the connection advances to the next protocol phase despite no policy being assigned.
3. Open a session channel, request a terminal, and submit an execution request.
4. Supply username `-2` so the login helper reads its trusted identity record from file descriptor 2 (the client terminal).
5. Send a NUL-delimited record naming the administrator and full permission set; helper installs it without normal authentication.
**How found:** Compared vulnerable vs fixed RouterOS releases, traced changes through the SSH service and login process, and picked the advisory path with fewest prerequisites (CVE-2026-67279, no creds needed). Patch diffing revealed the missing policy check in the dispatcher and the new validLoginParamInput rejecting leading dashes.
**Exploitation:** Attacker reaches the login helper unauthenticated via the rekey bypass, then feeds a crafted identity record through fd 2 using username `-2`, obtaining a full-privilege admin session. Field devices showed persistence via a `logrotate` script and `daily-maint` scheduler recreating a full-privilege account daily, with per-device passwords and owner="0".
**Escalation:** Stage-one auth-state bypass crosses the trust boundary to reach the login helper; stage-two fd-injection converts that into a trusted admin identity, then persistence via scheduled script recreating the account.
**Insight:** When patch-diffing, look for legacy local-only interfaces (fd-selector args, dash-prefixed params) reachable from network input after any auth-state desync; a rekey or state-transition bug can expose them. Numeric owner="0" on RouterOS objects is a hunting lead for chain-created persistence.

## Proof of concept (copied exactly from the original report)

**Detector differential: rekey opens channel without auth**

```
[VULNERABLE] router.example.net:22 
 control (no rekey): refused [Unable to open channel.] 
 test (rekey) : opened [channel opened without userauth (SSH-2.0-ROSSSH)]
```

**Lab PoC: chain-created scheduler shows owner 0**

```
# created through the chain 
name="poc-test" ... owner="0" 
 
# created through a normal admin login 
name="normal-test" ... owner="admin"
```

**Field artifact: logrotate script and daily-maint scheduler**

```
/system script print detail where owner="0" 
 0 name="logrotate" owner="0" 
 source=<redacted: recreates a full-privilege account if absent> 
 
/system scheduler print detail where owner="0" 
 0 name="daily-maint" start-time=03:00:00 interval=1d on-event=logrotate owner="0"
```