MikroTik runs an enormous share of the world's small-network and ISP edge — which is exactly why it's been botnet fuel twice over. This is the other side of the RouterOS series: what an attacker actually does to a MikroTik on an engagement, from finding an exposed Winbox port to owning the box and living in it, with the one-line fix for each. The companion to Securing RouterOS.
This is for authorized testing — your own lab, a CTF, or an engagement with written scope — and to show defenders precisely what they're up against. Attacking RouterOS you don't own or aren't contracted to test is illegal. Build a lab (CHR — Cloud Hosted Router — runs free in a VM) and point any testing at that. Every section closes with the fix, cross-linked to Securing RouterOS. This post is written defender-first: the goal is that you find these on your own estate before anyone else does.
MikroTik compromises follow the same shape as the Cisco ones: it's almost never a memory-corruption exploit, it's exposure plus a known bug or a weak credential. The device is cheap, capable, and everywhere — small ISPs, cafés, remote sites — and a huge number sit on the internet with Winbox (TCP 8291) or the API (8728) reachable and RouterOS from whenever they were unboxed. That combination built VPNFilter (2018) and the Meris botnet (2021, one of the largest DDoS sources ever recorded).
The kill-chain is predictable: find the management ports, get in via the classic Winbox flaw or weak/default creds, loot the config, then live in it — because a router is the perfect vantage point for sniffing and pivoting. Each stage ends with the RouterOS setting that removes it. The value here is the fix list, not a copy-paste exploit.
01
MikroTik has a giveaway fingerprint: Winbox on 8291 is almost unique to RouterOS, and the box often answers MNDP (the MikroTik discovery protocol) on the LAN, coughing up its identity and version.
# 8291 open is a near-certain RouterOS tell. Sweep your own range for it: $ nmap -Pn -p 8291,8728,8729,22,80 --open 203.0.113.0/24 203.0.113.10 8291/tcp open winbox 8728/tcp open mikrotik-api # On-LAN: MNDP (UDP 5678) broadcasts identity, model and version. $ tcpdump -nn -i eth0 udp port 5678 -A -c 1 Identity: CoreRTR Version: 6.42.11 Board: RB750 Platform: MikroTik # Version tells you instantly whether known CVEs apply. Note it.
8291/8728 should never be internet-facing. A default-drop input firewall makes the recon above return nothing from the WAN, and scoping MNDP/discovery to trusted interfaces removes the on-LAN freebie. Microsoft's free routeros-scanner is a good way to audit your own fleet for exposure and indicators. You cannot be exploited on a port an attacker can't reach.
02
The bug that made MikroTik infamous. A flaw in the Winbox service on RouterOS before 6.42.12 let an unauthenticated attacker read files off the device — including the admin credential store. No password needed; reach the port, and the box gives up its own login.
You don't need the exploit code to understand the lesson. The class of bug is pre-authentication information disclosure on a management service: once an attacker can read arbitrary files from an unauthenticated position, recovering the stored admin credentials is a formality, and from there they have full RouterOS access. Public tooling for it has existed for years; it was mass-exploited at internet scale and folded into VPNFilter. The credentials it yields are then reused directly, or the box is simply reconfigured by the now-authenticated attacker.
CVE-2018-14847 is long fixed, so "just patch" sounds sufficient — but it misses the point. The same failure mode (an unauthenticated bug in a management service exposed to the internet) will recur with the next CVE that isn't written yet. The durable fix is don't expose the management plane at all: a Winbox/API port the internet can't reach is immune to the bugs not yet public. Patch and firewall it off the WAN (Securing RouterOS §02), and reach it over a WireGuard tunnel instead. If you find a box that was exposed and unpatched, treat it as compromised and rebuild — don't just upgrade over the top.
03
Not every win needs a CVE. Old RouterOS shipped admin with a blank password; plenty of boxes still have it, or a weak password chosen once and never rotated. And the binary API on 8728 is a full credentialed config channel that's easy to brute where it's exposed.
# The blank-admin check: does the box still accept the factory login? # (Do this against YOUR devices to prove they were changed.) $ ssh admin@203.0.113.10 # blank password should be rejected # Exposed plaintext API on 8728 is a credentialed control channel and a # brute-force target. It should not be reachable from untrusted networks. $ nmap -p 8728,8729 --open 203.0.113.0/24 # 8728 open = plaintext API exposed
Remove the default admin, use per-person accounts in least-privilege groups, and enforce strong passwords (First Contact and Securing RouterOS cover both). Disable plain api outright; if automation needs it, use api-ssl bound to the automation host only. Rate-limiting repeated auth failures on the input chain turns a brute-force into a non-event.
04
RouterOS ships several services that are handy in a lab and a liability in production. The bandwidth-test server is the standout: reachable, it's both a credential-brute target and a way to saturate the box or the link on demand.
# Things to confirm are OFF / restricted on your own boxes: bandwidth-test server (btest) -> DoS + brute target www / ftp -> cleartext mgmt, extra surface romon -> L2 management mesh, if unscoped mac-server / mac-winbox -> L2 mgmt on untrusted ports socks proxy -> an attacker's favourite pivot (see §05) $ nmap -p 2000,21,80,1080 --open 203.0.113.10 # btest/ftp/www/socks
/tool bandwidth-server set enabled=no, disable www/ftp, scope mac-server and discovery to trusted interfaces, and leave romon and the SOCKS proxy off unless you deliberately deploy them on a trusted segment. Every disabled service is one fewer thing an attacker can reach — the whole of Securing RouterOS §01/§04.
05
Compromising a router isn't the goal; it's the position. A router sees all the traffic, sits inside the perimeter, and reboots rarely — the ideal place to persist, watch, and pivot. Knowing what an attacker does from here tells you what to look for.
| What they do from the box | Why it matters to you |
|---|---|
| Enable the SOCKS proxy | Turns your router into a pivot into the internal network — check /ip socks is off. |
| Stream the packet sniffer | Passive interception of everything crossing the box — check /tool sniffer isn't running/streaming. |
| Add a scheduler + script | Persistence and beaconing that survive reboots — audit /system scheduler and /system script. |
| Inject a web proxy / DNS static | Redirect or inject into user traffic (Meris-style) — check /ip proxy, /ip dns static. |
| Add a hidden user / SSH key | Backdoor access — reconcile /user and /user ssh-keys against your records. |
| Export the config | Every PSK, VPN key and credential leaves with them — rotate secrets after any suspected compromise. |
An attacker who owns the router owns its local logs, so the remote syslog copy is the one you investigate with — and the account topic shows unexpected logins. Keep a version-controlled /export baseline (Backup and Recovery) so a diff surfaces an injected scheduler, user, or proxy immediately. After any confirmed compromise, rebuild from clean and rotate every secret the box held — a config export means they all leaked.
06
When I review a MikroTik on an engagement, this is the pass. Run it against your own boxes first — each line is a finding waiting to happen.
| Check | Why it's a finding |
|---|---|
| 8291 / 8728 reachable from WAN | Management plane exposed — the root cause of nearly every compromise (§01/§02) |
| RouterOS below current stable | Known CVEs apply; unpatched + exposed = owned (§02) |
| Default admin / weak password | No exploit required (§03) |
Plain api, www, ftp, telnet enabled | Cleartext or brute-able management channels (§03/§04) |
| btest / romon / socks enabled | DoS, L2 management, and pivot surface (§04/§05) |
| No off-box logging | Compromise is invisible and local logs are untrustworthy (§05) |
| Unexpected scheduler/script/user | Persistence or backdoor — compare to baseline (§05) |
Takeaways
NOCTIS runs authorized network penetration tests and RouterOS configuration audits across Crete — exposure, patch level, weak creds, leftover services, and signs of a box already lived-in — with a prioritized, fix-first report, not a scanner dump.
Book a Discovery Call →