Zbtlink Routers Shipped With Built-In Backdoor Handing Out Root Shells to Anyone Listening
Chinese router manufacturer Zbtlink has a problem. Every firmware image available on its download page, spanning over two years and covering at least 20 router models, contains a hidden implant that phones home to Chinese servers and hands out unauthenticated root shells to whoever picks up.
Researchers at VulnCheck discovered the implant, which they've named ENDLESSDOORS, embedded in all 21 firmware images currently listed on Zbtlink's site. It starts automatically at boot via an init.d script called 'skworker' and beacons outbound to command-and-control infrastructure as frequently as every 35 seconds.
The thing disguises itself as a Linux kernel thread. In reality it's a userland process running as root, quietly blending in with legitimate kworker processes while doing something considerably less legitimate.
At its core, ENDLESSDOORS is built on an obscure tool called rctl, short for 'remote control linux'. Jacob Baines, VulnCheck's CTO, traced it to a GitHub repository uploaded in January 2015 and never updated since. The code implements a basic C2 client-server model. The server listens on port 7000, accepts connections from clients, and can push shell commands or tell the client to open a reverse bash shell. Simple, effective, and apparently good enough to ship in consumer hardware for years.
The version running on affected Zbtlink devices contacts four endpoints: zbtctl.epplink.net, 47.107.224.89, online-string.com, and rbdg4nzqadui.wikaba.com.
There is no authentication. No handshake. No verification of any kind. The implant sends a 'hello' along with the device's LAN MAC address, then executes whatever comes back. One specific command, 'rctlbash', tells it to open a second connection on port 7001, spin up a pseudo-terminal, spawn /bin/sh, and bridge them together. The result is a live, interactive root shell.
As Baines put it: the entire protocol vocabulary consists of two instructions. Run this as root, and give me a root shell. Anyone able to intercept the outbound traffic, or control DNS resolution for that wikaba.com domain, can own any device running this implant without ever needing inbound access from the internet.
Twenty models are confirmed affected, including various WE, WG, and Z-series units. The full list includes the CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM.
Zbtlink pulled the firmware from its download page after VulnCheck went public. A message on the site acknowledges 'security vulnerabilities' and promises patched firmware is in development.
The company's response to press queries was predictably damage-limiting. A spokesperson told The Hacker News the feature exists solely for after-sales maintenance, and that it's 'generally retained only on sample units.' They also noted that customers running OEM or ODM builds typically use their own firmware rather than Zbtlink's defaults, and that customer privacy is a top priority. The classic distancing manoeuvre.
In a subsequent statement, Zbtlink went further, claiming the remote management component is only activated with 'explicit request and authorization' from customers, and has never been used for unauthorised access. They've also announced suspension of sales on affected models while firmware updates are prepared.
If you're running any of the listed hardware, check your running processes, look for files including /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block outbound traffic to those four endpoints immediately. Waiting for a patch from a manufacturer whose 'maintenance feature' quietly called home for two-plus years probably shouldn't be your only plan.