[CuteGhost666]

The internal network of Libyan Airlines was successfully compromised through a vulnerability in the SSH service using a weak password for the "admin" account (123456). We were able to gain full control of a MikroTik RouterOS x86 device (version 6.49.13) operating as the main gateway for the internal network. Traffic was redirected, and control over all connected interfaces was obtained.

Support: The BlackH4t

Contact: CuteGhostSec

Session: 05f3536077d949ad71ca61bb26562f873ef01d165d6ecdbc0e7815600975346150

Compromised Device Information:

- Device: MikroTik RouterOS x86

- Version: 6.49.13

- Device Name: 15123_1812358

- Processor: QEMU (x86)

- Memory: 1920 MB (1637 MB free)

- Uptime: 2 days and 10 hours

- CPU: 5 cores at 2593 MHz, 12% load

Controlled Internal Networks:

More than 50 internal subnets were discovered, indicating a large-scale infrastructure that includes:

10.1.0.0/16 (OUT1)

10.2.0.0/16 (OUT2)

10.3.0.0/16 (OUT3)

10.4.0.0/16 (OUT4)

192.168.88.0/24 (WAN)

192.168.10.0/24 (wan 10.1)

192.168.100.0/24 (wan 10.1)

192.168.77.0/24 (M2)

192.168.200.0/24 (OUT1)

192.168.140.0/24 (OUT2)

192.168.150.0/24 (OUT1)

192.168.110.0/24 (OUT2)

192.168.11.0/24 (OUT2)

192.168.30.0/24 (OUT1)

192.168.101.0/24 (OUT2)

192.168.130.0/24 (OUT3)

192.168.40.0/24 (OUT3)

192.168.60.0/24 (OUT2)

192.168.50.0/24 (OUT3)

192.168.41.0/24 (OUT3)

192.168.17.0/24 (OUT1)

192.168.120.0/24 (OUT1)

192.168.181.0/24 (OUT4)

192.168.170.0/24 (OUT4)

192.168.35.0/24 (OUT1)

192.168.34.0/24 (OUT1)

192.168.44.0/24 (OUT3)

192.168.1.0/24 (OUT2)

192.168.210.0/24 (OUT2)

Exposed Services on the Internal Network:

Multiple active devices were discovered across the network. The networks 192.168.10.0/24, 10.1.2.192/28, 192.168.50.0/24, and 192.168.97.0/24 were scanned, revealing multiple devices with open ports, including SSH, HTTP, HTTPS, and the MikroTik Winbox service.

User Management System (Hotspot):

A Hotspot system was found operating on the device with a large number of active users. The login records show both failed and successful login attempts originating from internal IP addresses, indicating the presence of a system for managing users and controlling Internet access