
When enabled, RouterOS gives you an ash shell if you login with id “devel” via telnet. RouterOS has a hidden “devel” login which is only enabled when specific conditions are met.

This article suggests a simple trick to get a temporary root shell on RouterOS which can only be used on virtual machines and is easy to use. So we had to find another way to acheive the root shell, and we did. The netboot jailbreak method doesn’t work on virtual machines. While researching RouterOS, we eventually wanted to use virtual machines as a testing environment for various reasons.

However, You need an actual RouterBOARD to use this method, and it is a bit complicated process to generate a modified kernel image and network boot through it. This method achieves a root shell by booting through a modified kernel image. Thankfully, there is a way to jailbreak RouterOS v7 using netboot functionality. Unfortunately, most of the methods are no longer available on the latest RouterOS version. Many vulnerability researchers working on RouterOS felt the same and found various ways to enable the root shell on RouterOS. How to root your RouterOS v7 Virtual Machineįinding vulnerabilities in RouterOS is tricky, and this is especially because it does not provide a shell environment like ash or bash.
