Fix for winbox vulnerability

#!/bin/bash

check_password() {
        pass=$1

        identity=$(sshpass -p "$pass" ssh -o "ConnectTimeout 4" -p "$SSH_PORT" -MS "$ip" "$USERNAME@${ip}" ':put [/system identity get name]' 2>/dev/null)
        return $?

}

fix_config (){
	pass=$1
# https://forum.mikrotik.com/viewtopic.php?f=21&t=137572
	checklist=(
# Firewall auto-fix - dangerous if you had disabled drop rules before infection (can't imagine why, though)
':if ([:len [/ip firewall filter find where action=drop disabled]] > 0) do={:put "Firewall drop rules were disabled"; /ip firewall filter enable [find action=drop]}'
':if ([:len [/ip firewall filter find chain=input action=accept dst-port="8291"]] > 0) do={:put "Winbox had default firewall accept rule";/ip firewall filter remove [find chain=input action=accept dst-port="8291"]}'
# Use this if you need to check firewall rules manually
#':if ([:len [/ip firewall filter find where action=drop disabled]] > 0) do={:put "Disabled firewall drop rules:"; /ip firewall filter print where  action=drop disabled}'
# Winbox
':if ([/ip service get winbox disabled] != true) do={:put "Winbox was enabled"; /ip service disable winbox}'
# Socks
':if ([/ip socks get port] != 1080) do={:put "Socks Port was not 1080"; /ip socks set port=1080}'
':if ([/ip socks get enabled] != false) do={:put "Socks was enabled"; /ip socks set enabled=no}'
':if ([:len [/ip socks access find src-address~"95.154.216.128"]] > 0) do={:put "ip socks access had rule for 95.154.216.128"; /ip socks access remove [find src-address~"95.154.216.128"]}'
# Script and scheduler
':if ([:len [/system script find source~"ikrotik.php"]] > 0) do={:put "Script containing \"ikrotik.php\" found"; :foreach s in=[/system script find source~"ikrotik.php"] do={/system scheduler remove [find on-event~[/system script get $s name]]}; /system script remove [find source~"ikrotik.php"]}'
# File mikrotik.php
':if ([:len [/file find name="mikrotik.php"]] + [:len [/file find name="Mikrotik.php"]] > 0) do={ :put "File [Mm]ikrotik.php was found"; /file remove [find name="mikrotik.php"]; /file remove [find name="Mikrotik.php"];}'
# User "service"
':if ([:len [/user find name="service"]] > 0) do={:put "User \"service\" existed"; /user remove [find name="service"]}'
# And reboot if needed
#'/system reboot'
	)

	for command in "${checklist[@]}"
	do
		output+="\n"
		output+=$(sshpass -p "$pass" ssh -p "$SSH_PORT" -S "$ip" "$USERNAME@${ip}" "$command" 2>/dev/null)
	done

	output+="\n"
	output=$(echo -e "$output" | tr '\r' ' ' | grep -v '^[[:space:]]*$')

	if [[ "$output" == "" ]]
	then
		echo "- ok"
	else
		echo "- INFECTED"
	       	echo "Fixing config. It won't hurt.. much. Symptoms:"
		echo "$output"
		echo "Don't forget to upgrade."
	fi

}

DEFAULT_PASS="admin"
USERNAME="admin"
SSH_PORT="22"

ip=$1
password=${2:-$DEFAULT_PASS}

check_password $password
errcode=$?

echo -n "$ip "

echo -n "${identity:-unknown }" | tr '\r' ' '

case $errcode in
	0)
		fix_config $password
	;;
	5) if check_password $DEFAULT_PASS
	then
		fix_config $DEFAULT_PASS
	else
		echo "- invalid password"
	fi

	;;
	255) if (ping -c 2 -W 2 $ip >/dev/null 2>&1)
	then
		echo "- host is up, cannot connect via ssh"
	else
		echo "- host is down, cannot connect via ssh"
	fi
	;;
	*) echo "- unknown error $?"
esac