Zbtlink MQWrt yunmgrd (SPEAKINGSTONE) Factory-Installed Cloud C2 Implant

#!/usr/bin/env bash
# check_speakingstone.sh — Detect SPEAKINGSTONE (CVE-2026-74232) indicators
# Usage: sudo bash check_speakingstone.sh <CIDR>
# Requires: nmap, dig, arp (standard on Linux/macOS)
# Exit codes: 1=VULNERABLE (indicators found), 0=PATCHED (no indicators), 2=UNKNOWN

set -euo pipefail

SUBNET="${1:-}"
if [ -z "$SUBNET" ]; then
  echo "Usage: $0 <CIDR subnet to scan, e.g. 192.168.1.0/24>"
  exit 2
fi

VULN=0

# Known SPEAKINGSTONE C2 domains
C2_DOMAINS=("ac-link.com" "www.ac-link.com" "findmyipaddr.com" "www.findmyipaddr.com")
C2_IP="47.107.224.89"

echo "=== CVE-2026-74232 SPEAKINGSTONE Detection ==="
echo "[*] Checking DNS resolution of known C2 domains..."
for domain in "${C2_DOMAINS[@]}"; do
  resolved=$(dig +short "$domain" 2>/dev/null | head -1)
  if [ -n "$resolved" ]; then
    echo "[!] $domain resolves to $resolved"
    if [ "$resolved" = "$C2_IP" ]; then
      echo "    WARNING: Resolves to known ZBT C2 IP ($C2_IP)"
    fi
  fi
done

# Known Shenzhen Zhibotong OUI prefixes (partial list)
# Check IEEE OUI database for complete list
ZBT_OUIS=("44:d1:fa" "44:D1:FA" "e4:95:6e" "E4:95:6E")

echo ""
echo "[*] Scanning $SUBNET for devices with Zbtlink-associated MAC prefixes..."
nmap -sn "$SUBNET" -oG - 2>/dev/null | grep "Host:" | awk '{print $2}' | while read -r ip; do
  mac=$(arp -n "$ip" 2>/dev/null | grep -oE '([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}' | head -1)
  if [ -n "$mac" ]; then
    mac_prefix=$(echo "$mac" | cut -d: -f1-3 | tr '[:upper:]' '[:lower:]')
    for oui in "${ZBT_OUIS[@]}"; do
      oui_lower=$(echo "$oui" | tr '[:upper:]' '[:lower:]')
      if [ "$mac_prefix" = "$oui_lower" ]; then
        echo "[!!!] VULNERABLE: Device at $ip has Zbtlink OUI ($mac)"
        VULN=1
      fi
    done
  fi
done

echo ""
echo "[*] Checking for outbound UDP/10000 traffic to C2 IP (requires iptables/conntrack)..."
if command -v conntrack &>/dev/null; then
  hits=$(conntrack -L 2>/dev/null | grep "dst=$C2_IP" | grep "dport=10000" | wc -l)
  if [ "$hits" -gt 0 ]; then
    echo "[!!!] VULNERABLE: $hits active connections to C2 IP $C2_IP on UDP/10000"
    VULN=1
  else
    echo "[OK] No active conntrack entries to C2 IP on UDP/10000"
  fi
else
  echo "[SKIP] conntrack not available — check firewall logs manually for UDP/10000 to $C2_IP"
fi

echo ""
if [ "$VULN" -eq 1 ]; then
  echo "RESULT: VULNERABLE — SPEAKINGSTONE indicators detected. Remove affected devices immediately."
  exit 1
else
  echo "RESULT: PATCHED — No SPEAKINGSTONE indicators found on scanned subnet."
  echo "NOTE: Run against all network segments. Check for white-labeled OEM devices manually."
  exit 0
fi