4rt-net/mikrotrick_pocTesting tool for the Mikrotrick exploit (CVE-2026-67276)
An automated behavioral validator designed to detect the SSH public key authentication bypass vulnerability in MikroTik RouterOS (CVE-2026-67276).
The script tests whether an SSH service incomplete-validation flaw allows authentication by establishing a handshake using a forged signature matching only the targeted public key's modulus.
CVE-2026-67276 stems from incomplete RSA public-key verification within the RouterOS SSH daemon handler. When processing a client's public key authentication request, affected versions match only the key type and the RSA public modulus ($n$), omitting validation of the public exponent ($e$).
An operator who possesses the target user's configured authorized public key can forge a login payload. By submitting an ephemeral key blob where the exponent is set to $1$ ($e=1$) alongside the valid authorized modulus, a mathematically predictable signature matching the exact structure the verifier expects can be passed. This bypasses authentication completely without possessing or needing the corresponding private key.
ssh-rsa OpenSSH public key file.ssh-rsa, rsa-sha2-256, or rsa-sha2-512).The validator requires Python 3 and the paramiko library for custom SSH message construction.
pip install paramiko
python3 ssh_modulus_forge_check.py -H <TARGET_IP> -u <USERNAME> -k <PATH_TO_AUTHORIZED_PUBLIC_KEY>
| Flag | Description | Default |
|---|---|---|
-H, --host | Target host IP address or hostname. | Required |
-p, --port | Target SSH port number. | 22 |
-u, --user | Target username to validate. | Required |
-k, --pubkey | Path to the legitimate .pub file bound to the target account. | Required |
--sig-alg | Force signature type (ssh-rsa, rsa-sha2-256, rsa-sha2-512). | auto |
--exec | Remote command to execute as proof-of-access upon success. | None |
--timeout | Network and authentication connection timeouts in seconds. | 10 |
python3 ssh_modulus_forge_check.py -H 192.168.88.1 -u admin -k id_rsa.pub --exec "/system resource print"
To protect vulnerable devices, ensure that RouterOS installations are updated to fixed releases immediately. If patching cannot be scheduled natively, restrict administrative access to the service by enforcing localized IP firewall rules (/ip firewall filter) or using RouterOS services management (/ip service) to limit allowed source addresses.
This implementation is intended solely for defensive behavior verification, credential auditing, and patch compliance validation on authorized networks.