Skip to content

README.md

Latest commit

 

History

History
115 lines (82 loc) · 3.88 KB

README.md

File metadata and controls

115 lines (82 loc) · 3.88 KB
Raw

MikrotikAPI-BF — Nmap NSE Scripts

Nmap Scripting Engine (NSE) scripts for MikroTik RouterOS security assessment.
Complement the main Python tool with Nmap-native scanning capabilities.

Installation

Method 1 — pip (recommended)

pip install mikrotikapi-bf
# NSE scripts are installed automatically
mikrotikapi-bf --nse-path   # prints the NSE scripts directory

Method 2 — Manual copy

# Linux/macOS
cp nse/*.nse /usr/share/nmap/scripts/
nmap --script-updatedb

# Windows
copy nse\*.nse "C:\Program Files (x86)\Nmap\scripts\"
nmap --script-updatedb

Method 3 — Direct path

nmap --script ./nse/mikrotik-routeros-version.nse <target>

Scripts

Custom Scripts (mrhenrike/MikrotikAPI-BF)

Script Ports Category Description
mikrotik-routeros-version.nse 80,443,888,8291,8728,8729 discovery Fingerprint RouterOS version from multiple vectors
mikrotik-api-brute.nse 8728,8729 brute Full RouterOS API brute-force (6.x MD5 + 7.x plaintext)
mikrotik-default-creds.nse 8728,8729,80,443 auth Test default/empty credentials on all interfaces
mikrotik-api-info.nse 8728,8729 discovery Authenticated info dump (users, services, firewall)
mikrotik-winbox-cve-2018-14847.nse 8291 vuln Winbox credential disclosure (Chimay-Red / CVE-2018-14847)

Official Nmap Scripts (bundled for convenience)

Script Ports Category Source Description
mikrotik-routeros-brute.nse 8291 brute Nmap official RouterOS 6.x Winbox protocol brute-force
mikrotik-routeros-username-brute.nse 8291 brute Nmap official Winbox username enumeration

Community Scripts

Script Ports Category Source Description
broadcast-mndp-discover.nse UDP/5678 broadcast cldrn/external-nse-script-library MikroTik MNDP neighbor discovery broadcast

Usage Examples

# Full discovery scan (all MikroTik scripts)
nmap -p 80,443,8291,8728,8729 \
  --script "mikrotik-*" \
  -sV 192.168.1.0/24

# Version fingerprint only (safe, no auth)
nmap -p 80,8291,8728 --script mikrotik-routeros-version <target>

# Check for CVE-2018-14847 (Winbox credential disclosure)
nmap -p 8291 --script mikrotik-winbox-cve-2018-14847 <target>

# Brute-force API with wordlists
nmap -p 8728 --script mikrotik-api-brute \
  --script-args userdb=users.lst,passdb=passwords.lst \
  <target>

# Quick default credential check
nmap -p 8728,80 --script mikrotik-default-creds <target>

# Authenticated info dump (after finding creds)
nmap -p 8728 --script mikrotik-api-info \
  --script-args mikrotik-api-info.user=admin,mikrotik-api-info.pass=C0C0D3GR120 \
  <target>

# Full vulnerability assessment (combine with Python tool)
nmap -p 8728 --script mikrotik-routeros-version,mikrotik-default-creds <target>
python mikrotikapi-bf.py -t <target> --scan-cve -U admin -P <found_pass>

CVE Coverage via NSE

Script CVE
mikrotik-winbox-cve-2018-14847.nse CVE-2018-14847 (CRITICAL 9.1)
mikrotik-routeros-version.nse Version mapping to all applicable CVEs
mikrotik-api-brute.nse Authentication exposure and brute-force posture validation (TCP/8728)
mikrotik-default-creds.nse Default/empty credential validation across API and REST

References