Flashing SwOS from Windows

I recently acquired a cheap used Mikrotik RB250GS to play with port mirroring and VLAN tagging. The switch came with the original SwOS firmware which was buggy to the extent that firmware upgrade over the web interface itself was failing. The other method to update the firmware is through BOOTP. However, all guides out there only show the instructions to perform the upgrade from a Mikrotik router. Since I did not own a Mikrotik router and did not want to shell out money for one, I had to figure out how to do it from Windows.

I used tftpd64 to perform the upgrade. The config file has been included below. Most of the parameters can be easily derived from the other guides and translated to tftpd64's config. However, there is one thus far undocumented attribute that I had to discover through logging and packet capture. The Mikrotik switch expects the firmware image file name to be fmware. You will need to rename the file name before placing it in the BaseDirectory in the config. The switch should now be able to find the file and perform the firmware upgrade successfully. 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
[DHCP]
Lease_NumLeases=1
IP_Pool=10.0.0.2
PoolSize=252
BootFile=
DNS=
DNS2=
WINS=
Mask=255.255.255.0
Gateway=10.0.0.1
Option42=
Option120=
DomainName=
Lease (minutes)=2880
AddOptionNumber1=0
AddOptionValue1=
AddOptionNumber2=0
AddOptionValue2=
AddOptionNumber3=0
AddOptionValue3=
AddOptionNumber4=0
AddOptionValue4=
AddOptionNumber5=0
AddOptionValue5=
AddOptionNumber6=0
AddOptionValue6=
AddOptionNumber7=0
AddOptionValue7=
AddOptionNumber8=0
AddOptionValue8=
AddOptionNumber9=0
AddOptionValue9=
AddOptionNumber10=0
AddOptionValue10=
Lease_0_MAC=00:00:00:00:00:01
Lease_0_IP=10.0.0.2
Lease_0_InitialOfferTime=02/18/2019/21:37:18
Lease_0_LeaseStartTime=06/10/2024/10:35:18
[TFTPD32]
BaseDirectory=C:\path\to\directory\here\file
TftpPort=69
Hide=0
WinSize=0
Negociate=0
PXECompatibility=1
DirText=0
ShowProgressBar=1
Timeout=3
MaxRetransmit=6
SecurityLevel=0
UnixStrings=1
Beep=0
VirtualRoot=1
MD5=0
LocalIP=
Services=15
TftpLogFile=
SaveSyslogFile=
PipeSyslogMsg=0
LowestUDPPort=0
HighestUDPPort=0
MulticastPort=0
MulticastAddress=
PersistantLeases=1
DHCP Ping=1
DHCP LocalIP=10.0.0.1
Max Simultaneous Transfers=100
UseEventLog=0
Console Password=tftpd32
Support for port Option=0
UseEventLog=0
Keep transfer Gui=5
Ignore ack for last TFTP packet=0
Enable IPv6=0
UnicastBOOTP=0
DHCP Double Answer=0
HttpBaseDirectory=.


Tags: Untagged

Similar Articles

Yubikey passwordless Windows local account login - Yubico used to publish a Windows Store application YubiKey for Windows Hello that allowed local non-domain joined accounts to login to Windows simply by inserting the YubiKey. However, that ...
Windows Trust Boundaries - Understanding Windows trust boundaries is important as a penetration tester as security vulnerabilities are usually found at these boundaries. As an application developer, understanding these ...
Crash Windows Event Logging Service - While trying to write an undetectable event log cleaner, I delved into the NTAPIs to try to prevent Event ID 1102 from being created. In the process, I stumbled upon a way to crash the Windows ...
Windows Persistency With OpenVPN GUI - OpenVPN GUI will automatically run the following batch files if it exists. No changes to config file is needed, just drop the batch file in place. Possible privilege escalation if user runs ...