goldaden/mikrotrick-verifierNon-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.
Non-destructive, behavioral verifier for the MikroTik RouterOS SSH authentication-bypass (CVE-2026-67279) — a.k.a. the MikroTrick chain.
probe. measure. decide. no payload.
أداة صغيرة تفحص سلوك جهاز RouterOS تملكه للتأكد عمليًا مما إذا كان البناء المثبَّت يعاني من تجاوز حالة المصادقة في SSH (المرحلة الأولى من MikroTrick) قبل أن تُرقّي.
--console (قراءة فقط).docs/GUIDE_AR.md.انسخ محتوى install_termux.sh والصقه في Termux، ثم:
# أولًا: تأكد أن الأداة تعمل — بلا شبكة وبلا أي جهاز
python mtx.py --selftest # -> 3/3
# ثانيًا: افحص جهازك
python mtx.py <عنوان-الجهاز> --port 22
على Termux عادةً يكون الأمر
pythonوليسpython3.
If a client requests an SSH key renegotiation (rekey) before authentication, an unpatched RouterOS build proceeds to the connection-protocol stage anyway and accepts opening a session channel with no login. The tool measures exactly that, and nothing more:
| Reading | Patched device | Vulnerable device | Normal SSH (e.g. OpenSSH) |
|---|---|---|---|
| Pre-auth rekey | fails, connection dropped | succeeds | succeeds |
| Session channel opened pre-auth | — (link already down) | accepted | refused |
| Verdict | Meaning |
|---|---|
VULNERABLE | Pre-auth session channel accepted — CVE-2026-67279 behaviour. |
PATCHED_SIGNATURE | Pre-auth rekey refused and connection dropped — patched-build signature. |
NOT_CONFIRMED | Rekey allowed but auth enforcement intact — exploitation not proven. |
UNREACHABLE | SSH port not reachable. |
INCONCLUSIVE | Ambiguous reading; review the raw details. |
The verdict is behavioral — RouterOS never reveals its version in the SSH banner, so compare against a patched control device to prove the tool discriminates (see the guide, step 4).
git clone https://github.com/<you>/mikrotrick-verifier.git
cd mikrotrick-verifier
python -m pip install -r requirements.txt
# 1) prove the tool works first -- offline, no device, no network
python mtx.py --selftest # -> 3/3
# 2) offline logic self-test (same logic, full harness)
python tests/selftest_inproc.py # -> 3/3
# 3) scan your own / authorized device
python mtx.py <host> --port 22 --timeout 8
python mtx.py <host> --json report.json
--console is passed explicitly; even then it
sends a read-only command (default /system resource print).Use only on devices you own or are explicitly authorized in writing to test.
/user print, /system scheduler print, /system script print, SOCKS/tunnels,
and unknown files on storage.ops; logs login failure for user -2 ... via ssh and
user added by ssh:-2@<ip>; source IPs 82.192.72.4, 103.102.31.18.CVE-2026-67279 affects RouterOS 6.x (6.0.0 – < 6.49.21) and 7.x. Full admin takeover was only reproduced on 7.x (needs companion CVE-2026-86060); on 6.x the bypass enables manipulation of the file namespace. 6.48.6 is in scope (alongside CVE-2023-30799 / CVE-2023-32154).
mikrotrick-verifier/
├── mtx.py # single-file, paste-in-place verifier (Termux-friendly)
│ # --selftest proves it works offline; --json / --console
├── install_termux.sh # one-paste installer for Termux
├── tools/
│ ├── mikrotrick_check.py # full-featured verifier (bundled checks, JSON reports)
│ └── mock_routeros.py # offline SSH mock (vulnerable / patched / normal)
├── tests/
│ ├── selftest_inproc.py # offline logic self-test -> 3/3
│ └── test_mtx_cli.py # end-to-end CLI test -> 3/3
├── docs/
│ └── GUIDE_AR.md # full Arabic guide
├── requirements.txt
└── LICENSE
MIT — see LICENSE.