ENDLESSDOORS Backdoor in Zbtlink Routers Can Enable Hijacked Root Shell Access
Summary
VulnCheck found the ENDLESSDOORS backdoor in firmware for at least 20 Zbtlink router models. The boot-starting implant uses an unauthenticated command channel that can be hijacked to obtain a root shell.
Key points
- VulnCheck found ENDLESSDOORS in all 21 available Zbtlink firmware images, covering at least 20 router models.
- The implant starts at boot through an init.d script named skworker and disguises itself as a Linux kworker process while running with root privileges.
- A customized version of rctl beacons to command-and-control infrastructure as often as every 35 seconds.
- The command channel has no authentication; the article says hijacking the communications or controlling resolution of rbdg4nzqadui[.]wikaba[.]com could enable control of the implant.
- The rctlbash command can open a second connection, spawn /bin/sh, and provide a live interactive root shell.
- Zbtlink said affected firmware was temporarily removed while it develops and validates patched firmware.
- Users were advised to check for skworker-related files and block the listed egress endpoints.
Article Details
- Attack Vectors
- ENDLESSDOORS is embedded in Zbtlink router firmware and starts automatically at boot via an init.d script named skworker.
- The implant masquerades as a Linux kworker process while running as a root-privileged userland process.
- The implant beacons to C2 endpoints without a handshake or authentication; the article says an attacker able to hijack the communication can send commands or obtain an interactive root shell.
- The rctl server can send shell commands or instruct the implant to open a second connection, spawn /bin/sh, and bridge a live root shell.
- Defensive Notes
- Check the process list for skworker-related processes.
- Scan for /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker.
- Block the listed egress endpoints.
- Zbtlink temporarily removed impacted firmware releases from download channels and said it was developing and validating patched firmware.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | online-string[.]com | Listed as one of the primary or secondary C2 endpoints contacted by affected models. |
| DOMAIN | rbdg4nzqadui[.]wikaba[.]com | C2 domain the implant is configured to contact; the article says control of its resolution can enable control of the implant. |
| DOMAIN | zbtctl[.]epplink[.]net | Listed as one of the primary or secondary C2 endpoints contacted by affected models. |
| IPV4 | 43[.]248[.]136[.]125 | IP address listed for the rbdg4nzqadui.wikaba[.]com C2 endpoint. |
| IPV4 | 45[.]32[.]81[.]152 | IP address listed for the online-string[.]com C2 endpoint. |
| IPV4 | 47[.]100[.]190[.]96 | IP address listed for the zbtctl.epplink[.]net C2 endpoint. |
| IPV4 | 47[.]107[.]224[.]89 | C2 endpoint configured in the analyzed ENDLESSDOORS implant. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe implant disguises its root-privileged userland process as a Linux kworker process.T1037.004 · RC ScriptsAn init.d script named skworker starts the implant at boot.T1059.004 · Unix ShellThe rctl server can issue shell commands, and the implant can spawn /bin/sh or a reverse bash shell.T1557 · Adversary-in-the-MiddleThe article says an attacker along the network path can hijack the unauthenticated client/server communication and control the implant.