Abstract

MikroTik RouterOS is a stand-alone operating system based on Linux, mainly for MikroTik manufactured routers. Thanks to its rich features, easy to use interface, and affordable price, Mikrotik router has been widely used around the world. Every coin has two sides. Because of its significant role in the network and wide usage, Mikrotik router has been a valuable target in the past few years.

RouterOS, which powers the devices, will pose a severe impact if been exploited. However, hunting bugs in RouterOS is not easy. RouterOS is designed in a modular fashion, andre-implement many low-level stuff. It provides a proprietary interprocess communication(IPC) mechanism for individual processes to communicate with each other, and introduces a custom "Nova Message" for data exchange. Hence, digging into its dense, hand-rolled C++ binaries filled with custom library calls is a daunting task. Gratefully, there are some awesome research against MikroTik RouterOS.

Inspired by them, in this talk, we will focus on the interprocess communication(IPC) mechanism, and show our attempts to test its robustness with a simple "fuzzer", which resulted in nearly 60 bugs. We will show our way to find the recently disclosed FoisHandler vulnerability, and depict another new vulnerability to achieve jailbreak on the latest stable 7.4 version.