Next, we focus on a key concept central to MikroTik: its proprietary messaging protocol used for IPC. Specifically, we focus on how firmware packages are cryptographically signed, and how we can bypass signing to obtain a developer shell in a MikroTik RouterOS virtual machine. We approach our overarching goal in four ways: first, we dive into MikroTik's RouterOS operating system, understanding how it loads firmware and boots processes. This knowledge will jump-start your research, tool development, or whatever MikroTik-related tinkering in which you are interested.

The goal of that talk, and this post, is to refresh the publicly available MikroTik knowledge and provide a crash course on MikroTik internals that will bring you from potentially zero experience to a point where you are familiar and comfortable with key MikroTik concepts and abstractions.

This blog post, which overviews our presentation at REcon 2022, outlines key knowledge and introduces tools that we created during our research over the past handful of months. In that time, MikroTik released a number of minor version updates and one major revision software upgrade, making some of the technical details obsolete.Ĭonsequently, we are left generally in the dark as to how MikroTik works, and digging into its dense, hand-rolled C++ binaries filled with custom library calls is a daunting task. Unfortunately, there is limited publicly available information about how this system-wide implementation works, and the good, technical information available is now a few years old. Where do you start? As opposed to many routers which act more as a collection of independent binaries for each service, MikroTik devices implement a system of interconnected binaries which perform tasks for one another. So, you want to start reverse engineering MikroTik routers.

Mikrotik firmware upgrade