Giter VIP home page Giter VIP logo

applejuice's Introduction

AppleJuice

Apple BLE Proximity Pairing Message Spoofing

๐Ÿ”ด Disclaimer

These scripts are an experimental PoC that uses Bluetooth Low Energy (BLE) to send proximity pairing messages to Apple devices.
This project is created for educational purposes and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials of this project.

Updates

9/21/23

Thanks to 0DayCTF the random option has been added!

To run with random :
python3 app.py --random
or
python3 app.py -r -i 20
to set to it to random and the time interval to 20ms, making it more spammy.

9/13/2023

After Techryptic's attempt to steal the work of myself and WillyJL, Willy has taken the time to give an insanely in-depth timeline of the events and proof of the work being stolen (Git and my typos dont lie!) Check out the full report below and please help us spread the word that the person who has been all over the news outlets claiming this as their work, stole the code and gave none of the actual developers credit.

The Controversy Behind Apple BLE Spam

Flipper Zero

Thanks to the amazing work of Willy-JL this has been added to the Flipper Zero Xtreme Firmware. It's currently in dev and will be officially released in the next update.

To install it now, follow the guide below from the Xtreme Firmware page to clone and compile the current dev build that contains the Apple BLE Spam app.

โš ๏ธ Warning!
We will not give basic support for compiling in our server. This is intended for people that already know what they are doing!

To download the needed tools:
$ git clone --recursive --jobs 8 https://github.com/Flipper-XFW/Xtreme-Firmware.git
$ cd Xtreme-Firmware/

To flash directly to the Flipper (Needs to be connected via USB, qFlipper closed)
$ ./fbt flash_usb_full

To compile a TGZ package
$ ./fbt updater_package

To build and launch a single app:
$ ./fbt launch APPSRC=some_appid

ESP-32

Thanks to ronaldstoner for porting this over to the ESP-32

Android

Check out this in-depth walk though by Mobile Hacker about running AppleJuice on a rooted Android phone.

About This Project

This was created in response to the various AppleTV spoof messages being sent out during DEF CON 31. After experiencing it first hand, I had to figure out what was happening. The existing research projects I could find (see credits) had great info but were both a couple years out of date with broken package dependencies, so I decided to take what I could from them and start building from there.

Hardware Requirements

To run these scripts you need a Linux machine with an internal Bluetooth card or a USB Bluetooth adapter.

All original testing was done on a Lenovo T480 with a built-in Bluetooth adapter.
Later tested on Raspberry Pi 3B+ and Raspberry Pi Zero W running Kali Linux with a Zexmte Long Range USB Bluetooth 5.1 Adapter with Dual Antenna.


Range
Range of messages by device type

Device Range
Lenovo Couple feet from machine
Raspberry Pi and long range adapter 20+ feet indoors in heavy BLE traffic

Installation Instructions

Please follow in this exact order or you might run into issues with bluetooth dependencies.

Clone the Main Repo

git clone https://github.com/ECTO-1A/AppleJuice.git && cd ./AppleJuice

Install dependencies

sudo apt update && sudo apt install -y bluez libpcap-dev libev-dev libnl-3-dev libnl-genl-3-dev libnl-route-3-dev cmake libbluetooth-dev

Dependencies requiring manual installation

โš ๏ธ Warning
The pybluez library is broken on GitHub and needs to be installed manually

Download the latest version 
pip install git+https://github.com/pybluez/pybluez.git#egg=pybluez

pycrypto is not maintained, be sure to install pycryptodome instead 
pip install pycryptodome

Install requirements

sudo pip install -r requirements.txt

Execute scripts without sudo

To be able to run without sudo, you need to set the capabilities of the python binary to allow it to access raw sockets. This is done with the following command

sudo setcap cap_net_raw,cap_net_admin+eip $(eval readlink -f $(which python))

Reboot Machine

Several users have reported the need for a reboot after installing the bluetooth packages in order for everything to work properly.

Usage

Before running the script, check that your Bluetooth adapter is connected and showing as hci0

Run hcitool dev to get a list of connected adapters

hcitool dev
Devices:
    hci0    00:00:7C:00:3A:13

๐Ÿ“ Note
If the adapter is showing as hci1 you will need to edit the dev_id variable in the scripts to match

Available options

All messages have been combined into a single app. You can now run app.py to get a list of available options.
To run the script use -d (number of message)

Example
app.py -d 13

python3 app.py
Please select a message option using -d.
Available message options:
1: Airpods
2: Airpods Pro
3: Airpods Max
4: Airpods Gen 2
5: Airpods Gen 3
6: Airpods Pro Gen 2
7: PowerBeats
8: PowerBeats Pro
9: Beats Solo Pro
10: Beats Studio Buds
11: Beats Flex
12: BeatsX
13: Beats Solo3
14: Beats Studio3
15: Beats Studio Pro
16: Beats Fit Pro
17: Beats Studio Buds+
18: AppleTV Setup
19: AppleTV Pair
20: AppleTV New User
21: AppleTV AppleID Setup
22: AppleTV Wireless Audio Sync
23: AppleTV Homekit Setup
24: AppleTV Keyboard
25: AppleTV 'Connecting to Network'
26: Homepod Setup
27: Setup New Phone
28: Transfer Number to New Phone
29: TV Color Balance

Examples

beatssolopro.py

Model: Beats Solo Pro

airpods_max.py

Model: Airpods Max

Credit

applejuice's People

Contributors

0day1day avatar 0dayctf avatar besix2 avatar ecto-1a avatar exme168 avatar liquidz00 avatar mryellowheart avatar n0xa avatar ronaldstoner avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

applejuice's Issues

Add others features like Android and Windows on app.py

@ECTO-1A great work ! It work pretty well everywhere, on rpi, on flipper, I'm not able to make it work on nethunter, even with external ble dongle, I'm working on it ๐Ÿ˜œ

Since the crash attack is possible on the flipper zero,
Any problem with python version ?

No module named 'bluetooth'

Screenshot from 2023-09-11 11-16-12

bluethoot device is showing up in hcitool dev as hci0
running on a pop os laptop with a mediatek wifi / bluethoot card

Not really spamming

Tried using the same external dongle as the PoC, but I have to lock and unlock the iphone to get another notification..

Port to rust.

Hi, since I couldn't find a way to contact @ECTO-1A directly, I'm gonna use this. Would you be fine, with me porting this to rust in my apple-ble project?

No module named 'utils.bluetooth_utils'; 'utils' is not a package

Cannot run it, facing the following error:

File "/home/kali/Tools/AppleJuice/Pair New Device Notifications/beatssolopro.py", line 16, in
from utils.bluetooth_utils import (toggle_device, start_le_advertising, stop_le_advertising)
ModuleNotFoundError: No module named 'utils.bluetooth_utils'; 'utils' is not a package

Compilation error: cannot convert 'std::string' {aka 'std::__cxx11::basic_string<char>'} to 'String'

C:\Users\admin\Desktop\EvilAppleJuice-ESP32-master\src\EvilAppleJuice-ESP32-INO\EvilAppleJuice-ESP32-INO.ino: In function 'void loop()':
C:\Users\admin\Desktop\EvilAppleJuice-ESP32-master\src\EvilAppleJuice-ESP32-INO\EvilAppleJuice-ESP32-INO.ino:80:37: error: cannot convert 'std::string' {aka 'std::__cxx11::basic_string'} to 'String'
80 | oAdvertisementData.addData(std::string((char*)DEVICES[index], 31));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| std::string {aka std::__cxx11::basic_string}
In file included from C:\Users\admin\AppData\Local\Arduino15\packages\esp32\hardware\esp32\3.0.0-alpha3\libraries\BLE\src/BLEServer.h:22,
from C:\Users\admin\AppData\Local\Arduino15\packages\esp32\hardware\esp32\3.0.0-alpha3\libraries\BLE\src/BLEDevice.h:21,
from C:\Users\admin\Desktop\EvilAppleJuice-ESP32-master\src\EvilAppleJuice-ESP32-INO\EvilAppleJuice-ESP32-INO.ino:5:
C:\Users\admin\AppData\Local\Arduino15\packages\esp32\hardware\esp32\3.0.0-alpha3\libraries\BLE\src/BLEAdvertising.h:36:29: note: initializing argument 1 of 'void BLEAdvertisementData::addData(String)'
36 | void addData(String data); // Add data to the payload.
| ~~~~~~~^~~~
C:\Users\admin\Desktop\EvilAppleJuice-ESP32-master\src\EvilAppleJuice-ESP32-INO\EvilAppleJuice-ESP32-INO.ino:83:37: error: cannot convert 'std::string' {aka 'std::__cxx11::basic_string'} to 'String'
83 | oAdvertisementData.addData(std::string((char*)SHORT_DEVICES[index], 23));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| std::string {aka std::__cxx11::basic_string}
C:\Users\admin\AppData\Local\Arduino15\packages\esp32\hardware\esp32\3.0.0-alpha3\libraries\BLE\src/BLEAdvertising.h:36:29: note: initializing argument 1 of 'void BLEAdvertisementData::addData(String)'
36 | void addData(String data); // Add data to the payload.
| ~~~~~~~^~~~

exit status 1

Compilation error: cannot convert 'std::string' {aka 'std::__cxx11::basic_string'} to 'String'

HCITool bluetooth device not showing.

Followed all of the correct dependancy installations, and have tried to use hcitool. My computer has a working bluetooth chip. It is enabled. I am running Kali Linux on VIrtualBox. When hcitool dev is ran, it shows no devices and as such, the program emits this error:
raceback (most recent call last):
File "/home/AppleJuice/app.py", line 148, in
main()
File "/home/AppleJuice/app.py", line 117, in main
toggle_device(dev_id, True)
File "/home/AppleJuice/utils/bluetooth_utils.py", line 97, in toggle_device
fcntl.ioctl(hci_sock.fileno(),
OSError: [Errno 38] Function not implemented

However, Kali Linux does recognise the device. I have enabled, disabled bluetooth, checked it, and rfkill recognises the device as unblocked hard and soft, with: the correct device id needed (hci0):

ID TYPE DEVICE SOFT HARD
0 bluetooth hci0 unblocked unblocked

Meaning that Kali Linux does know the bluetooth device exists.. When I run the bluetooth manager/adapter programs in Kali, cpu usage spikes but no gui shows up, meaning an issue with Kali? Tried to fix but no avail.. Any help?

Add message to the AirPods Pro 2 ?

With AirPods Pro 2, if you have engraving the case with Apple, the message is visible on the popup.

Is this a way to trick that and choose a message, like "powned" ?

Raspberry pi 0w 2 - Not working while running

I installed everything as recommended on my Raspberry pi 0w 2 (internal BLE),
but when I launch the program nothing happens on the iPhones around,
the program seems to be running well, but nothing happens around.

is this related to internal BLE ?

Edit : does this work on Raspberry pi 0w v1(internal BLE) ?
Or the external ble dongle is required?

about ADV_TYPE_DIRECT_IND_HIGH

ESP32.If I use this type, I can't get any message in my phone.but if i use other types, I can't get any message after 0.5 meter.I am very sorry that I have a long time to use English.Hope you can understand what I said.Thanks.

Doesn't really work

I have tested every single option, but none of them did anything. The weird part is that it says "Advertisement started" and according to Wireshark, the packets were send out. Nothing appeared on my phone. (iPhone 13 Pro) I don't know what the problem is. I am using the program on a Kali Linux VM in VirtualBox. My Host is an Intel MacBook Pro. I am using the intigrated bluetooth card via USB (Bluetooth works perfectly fine in the VM).

Error when entering the command - "pip3 install -r requirements.txt"

Hey, please support, I tried to use the application using 2 different devices (VM Kali on Vmware works on WindowsPC and NetHunter on Termux, downloaded from F-Droid works on new Oneplus), on both there is the same error when entering the same command - "pip3 install -r requirements.txt".
Log:
image
image
image

Sorry for the screenshots, but I can't copy :)
The same error occurs on Oneplus.
I noticed that the tutorial says "pip" and not "pip3", I tried again with "pip" - same error.

Thanks for your support, regards

New idea

Hello. We found a pop-up BLE signal for Android. Who can, please port it for NRF Connect. Or get manafactured data. I tried, but I couldn't. I don't understand well. I believe in you, thank you

File Traceback

I restarted and reinstalled many times, but erverytime i wanna start app.py with -d or random it gives me out 3 file tracebacks but no specefic error. please help(Im using an raspberry pi4 with kali installed)

The script doesn't seem to work on iPhone 5s

device :5s
ios:12.5.7
I use flipper zero device to install RM firmware. Use apple ble script to make the phone pop up device pairing notification

But the window cannot pop up using app.py
1
2023-10-06-17-48-35-802

permission error

Screenshot_2023-09-12-11-07-30-289_com termux
Traceback (most recent call last): File "/home/kali/AppleJuice/app.py", line 144, in main() File "/home/kali/AppleJuice/app.py", line 113, in main toggle_device(dev_id, True) File "/home/kali/AppleJuice/utils/bluetooth_utils.py", line 88, in toggle_device hci_sock = socket.socket(socket.AF_BLUETOOTH, File "/usr/local/lib/python3.9/socket.py", line 232, in init _socket.socket.init(self, family, type, proto, fileno) PermissionError: [Errno 13] Permission denied

M5Stack C plus no backlight

Hi,

When I upload code in my M5Stack C plus backlight led are off .
to fix this issue here is code :

// Boot/Help Screen
 digitalWrite(M5_LED, HIGH); //LEDOFF
 M5.Lcd.fillScreen(BLACK);
 M5.Lcd.setTextSize(3);
 M5.Lcd.setCursor(5, 10);
 M5.Lcd.setRotation(rotation);
 M5.Lcd.print("AppleJuice\n");
 M5.Lcd.setTextSize(2);
 M5.Lcd.print("For M5StickC-Plus\nBy Axon | IG: @4x0nn\n\nSide Key: Next\nM5 Key: Select");

Just add following command : M5.Axp.ScreenBreath(100);

// Boot/Help Screen
digitalWrite(M5_LED, HIGH); //LEDOFF
M5.Lcd.fillScreen(BLACK);
M5.Lcd.setTextSize(3);
M5.Lcd.setCursor(5, 10);
M5.Lcd.setRotation(rotation);
M5.Lcd.print("AppleJuice\n");
M5.Lcd.setTextSize(2);
M5.Lcd.print("For M5StickC-Plus\nBy Axon | IG: @4x0nn\n\nSide Key: Next\nM5 Key: Select");
M5.Axp.ScreenBreath(100);

Enjoy

Richard

Esp32 not working

Just tried the code for esp32 using an esp32-CAM module, it just doesn't work at all.

work only a few times

hi im using an external usb bluetooth adapter on a kali vm (virtualbox macos host [intel]) with latest kernel.
it started a few times the apple tv and the airpods max but after it doesnt work but the bluetooth adapter works in the manager.
with a reboot it works for few times and after still broke.

Incompatibility with iOS versions below 16

I've tested both the Linux version (through a Kali VM and a BLE 5.3 adapter) and the ESP32 implementation (with a NodeMCU ESP32) on two iPhones: an iPhone X and iPhone 4S running iOS 14 and 10 respectively. Neither of them work. It seems that this only works on iOS 16 because this attack is dependent on the popup notification in the photos, which seems to only be available on iOS 16.

Modulenotfounderror: utils.bluetooth_utils

Hello,
I'm using kalinethunter on oneplus7t with external bluetooth adapter. When i start:
Python3 app.py
I get error message about module missing
ModuleNotFoundError: no module name 'utils.bluetooth_utils' ; utils is not package

Do you have an idea where I'm making mistake? Thanks

Facing Issue while running OSError: [Errno 38] Function not implemented

Traceback (most recent call last):
File "/home/kali/AppleJuice/app.py", line 148, in
main()
File "/home/kali/AppleJuice/app.py", line 117, in main
toggle_device(dev_id, True)
File "/home/kali/AppleJuice/utils/bluetooth_utils.py", line 97, in toggle_device
fcntl.ioctl(hci_sock.fileno(),
OSError: [Errno 38] Function not implemented

idk why this is not working im using linux mint cinnamon

sudo python3 app.py --random
Advertising Started... Press Ctrl+C to Stop
An error occurred: PY_SSIZE_T_CLEAN macro must be defined for '#' formats
Traceback (most recent call last):
File "/home/mrscratchcat/AppleJuice/app.py", line 132, in main
start_le_advertising(sock, adv_type=0x03, min_interval=args.interval, max_interval=args.interval, data=bt_data)
File "/home/mrscratchcat/AppleJuice/utils/bluetooth_utils.py", line 234, in start_le_advertising
bluez.hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_ADVERTISING_PARAMETERS,
SystemError: PY_SSIZE_T_CLEAN macro must be defined for '#' formats

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/mrscratchcat/AppleJuice/app.py", line 148, in
main()
File "/home/mrscratchcat/AppleJuice/app.py", line 145, in main
stop_le_advertising(sock)
File "/home/mrscratchcat/AppleJuice/utils/bluetooth_utils.py", line 257, in stop_le_advertising
bluez.hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_ADVERTISE_ENABLE, cmd_pkt)
SystemError: PY_SSIZE_T_CLEAN macro must be defined for '#' formats

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.