matheus-garbelini / braktooth_esp32_bluetooth_classic_attacks Goto Github PK
View Code? Open in Web Editor NEWA Series of Baseband & LMP Exploits against Bluetooth Classic Controllers
A Series of Baseband & LMP Exploits against Bluetooth Classic Controllers
Hi there, is it possible to compile bt_fuzzer
and bt_exploiter
under arm-based linux system? Could you please provide some tutorials about it? Thanks a lot.
First total noob, just trying to learn BT attacks.
I did try and install this on kali linux. I was able to install everything, and update my dev board. but the fuzzer would not work. it gave a libtbb.0s.2 error. Found on the closed section its a kali linux error. I was able to install with Virtual Box and Ubuntu 18.04 and got it all working. Have not tested any attacks yet.
Question: My esp32-wrover-dev kit came with an lcd screen. when I first hooked it up, it would display an ESP32 screen. After the flash, it does not show anything any more. I am assuming this is normal. Just wanted to ask and make sure i didnt fry my board.
thanks and I looking forward to learning more on this attack.
I have run the BT fuzzer and it causes my BLE headphones to crash, and I would like to know which specific exploit/LMP test caused this. Is there a way to find out?
Thanks a lot for your time in advance
Hi Team,
I would like to check the BrakTooth vulnerability in my metering product before launching to market.
I have followed the provided steps in Ubuntu 18.04 VM machine and ESP32 Wrover kit.
While scanning for devices using the following command, getting segmentation fault in ESP32 and also taking too much time to open port /dev/ttyUSB1:
$ sudo bin/bt_exploiter --scan
Output is attached here for reference.
I have tried multiple options like updated configs file (/bt_config.json ), erased ESP32 flash and programmed again, flashed using idf.py (default ESP32 flashing script), validated "Hello world" example code and much more.
Can you please share your inputs on priority to resolve this issue.
Please let me know if any further information is required
Thanks and regards,
Patidar
LMP_encryption_key_size_req
packets, one after the other, the first with size 16, and the second with size 1 - because the 16 is never actually sent over the air, it's intercepted and rewritten to 1, and that's what goes over the air. If I'm correct about this, then my question is about the assessment accuracy of the test. Specifically, it treats a system as vulnerable if it sees an LMP_accepted
come back, in response to the LMP_encryption_key_size_req
. However in the original writeup of the KNOB PoC, it says:Android (tested only on a Pixel 2): If the target device sends first an LMP_accept
(in response to an LMP_start_encryption_req) and then an LMP_detach message
due to security reasons then the target device is patched against the KNOB attack.
My interpretation of that statement is that even on a patched machine, it is expected to see an LMP_accepted first, and only after that's seen, a patched system may end up tearing down the connection with an LMP_detach. (But that this is vendor-specific behavior, and he's just describing the Android behavior.)
If I'm interpreting this correctly, then isn't it necessary to remove the preemptive teardown in the knob.cpp (the m->stop = 1;
), and also add some sort of check for LMP_detach
temporarily proximate to the accept? (I don't know how to do that temporally proximate check, otherwise I'd propose a PR. But I did remove the m->stop = 1;
so I could just eyeball it.) Because basically as it is right now it seems like it will have some false positives on systems that behave like the mentioned Android.
m->stop = 1;
as above, and lets the connection proceed, one will be seeing encrypted packets after that, right? Is it possible to use the KNOB e0 1-byte-key brute force decryption on the packets stored in the BrakTooth output pcapng file? (I.e. have you ever tried that and succeeded? I'm currently getting an error in the existing decryption tests which I posted about before I can do any tests.)Aside: I know you don't officially support Ubuntu 22.04 right now, but in order to get the knob.cpp customization to compile there, I had to edit src/ModulesInclude.hpp
and change "extern" to "static" under all the "Main API (declarations)", otherwise it would error out.
p.s. this tool is good stuff!
Git screams "This repository is over its data quota. Account responsible for LFS bandwidth should purchase more data packs to restore access."
Is there an alternative way of downloading wdissector.tar.zst file?
Kind of blocked here after purchasing everything that is needed in order to do some tests...
Help is really appreciated.
Thanks
error while loading shared libraries: libtbb.so.2: cannot open shared object file: No such file or directory
I followed all the steps as required and even tho, it gets me that error.
Any help, please?
I'm running Kali
I recently ordered a ESP-WROVER-KIT and received a revision 3, so I was wondering if the firmware and attacks are compatible with this hardware revision.
Upon the firmware flash I receive the following output:
root@u18:~/src/braktooth_esp32_bluetooth_classic_attacks/release# python3 firmware.py flash /dev/ttyUSB1
Generating project.checksum
Flashing firmware...
Warning! Ignore unknown configuration option `reset_before_after_flash` in section [env:esp32doit-devkit-v1-jtag]
Warning! Ignore unknown configuration option `reset_before_after_flash` in section [env:esp32doit-devkit-v1-serial]
Processing esp32doit-devkit-v1-serial (platform: [email protected]; board: esp32doit-devkit-v1; framework: espidf; platform_packages: [email protected], [email protected]; upload_protocol: esptool; upload_port: /dev/ttyUSB1; monitor_port: /dev/ttyUSB1; monitor_speed: 4000000; monitor_filters: colorize, esp32_exception_decoder; build_flags: -w; upload_command: $PYTHONEXE $UPLOADER --chip esp32 --port $UPLOAD_PORT --baud 460800 --before default_reset --after hard_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x1000 $BUILD_DIR/bootloader.bin 0x8000 $BUILD_DIR/partitions.bin 0x10000 $BUILD_DIR/firmware.bin; extra_scripts: post:PlatformioScripts.py; reset_before_after_flash: true)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
before_upload(["upload"], [".pio/build/esp32doit-devkit-v1-serial/firmware.bin"])
Reset Done! EN pin toggled HIGH->LOW->HIGH
<lambda>(["upload"], [".pio/build/esp32doit-devkit-v1-serial/firmware.bin"])
AVAILABLE: esp-prog, espota, esptool, iot-bus-jtag, jlink, minimodule, olimex-arm-usb-ocd, olimex-arm-usb-ocd-h, olimex-arm-usb-tiny-h, olimex-jtag-tiny, tumpa
CURRENT: upload_protocol = esptool
MethodWrapper(["upload"], [".pio/build/esp32doit-devkit-v1-serial/firmware.bin"])
Using manually specified: /dev/ttyUSB1
/root/.platformio/penv/bin/python /root/.platformio/packages/tool-esptoolpy/esptool.py --chip esp32 --port /dev/ttyUSB1 --baud 460800 --before default_reset --after hard_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x1000 /root/src/braktooth_esp32_bluetooth_classic_attacks/release/.pio/build/esp32doit-devkit-v1-serial/bootloader.bin 0x8000 /root/src/braktooth_esp32_bluetooth_classic_attacks/release/.pio/build/esp32doit-devkit-v1-serial/partitions.bin 0x10000 /root/src/braktooth_esp32_bluetooth_classic_attacks/release/.pio/build/esp32doit-devkit-v1-serial/firmware.bin
esptool.py v3.0
Serial port /dev/ttyUSB1
Connecting....
Chip is ESP32-D0WD-V3 (revision 3)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: 08:b6:1f:ed:39:b8
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Changed.
Configuring flash size...
Auto-detected Flash size: 4MB
Compressed 25232 bytes to 15140...
Writing at 0x00001000... (100 %)
Wrote 25232 bytes (15140 compressed) at 0x00001000 in 0.4 seconds (effective 573.4 kbit/s)...
Hash of data verified.
Compressed 3072 bytes to 103...
Writing at 0x00008000... (100 %)
Wrote 3072 bytes (103 compressed) at 0x00008000 in 0.0 seconds (effective 1541.9 kbit/s)...
Hash of data verified.
Compressed 328416 bytes to 199214...
Writing at 0x00010000... (7 %)
Writing at 0x00014000... (15 %)
Writing at 0x00018000... (23 %)
Writing at 0x0001c000... (30 %)
Writing at 0x00020000... (38 %)
Writing at 0x00024000... (46 %)
Writing at 0x00028000... (53 %)
Writing at 0x0002c000... (61 %)
Writing at 0x00030000... (69 %)
Writing at 0x00034000... (76 %)
Writing at 0x00038000... (84 %)
Writing at 0x0003c000... (92 %)
Writing at 0x00040000... (100 %)
Wrote 328416 bytes (199214 compressed) at 0x00010000 in 4.5 seconds (effective 586.4 kbit/s)...
Hash of data verified.
Leaving...
Hard resetting via RTS pin...
after_upload(["upload"], [".pio/build/esp32doit-devkit-v1-serial/firmware.bin"])
Reset Done! EN pin toggled HIGH->LOW->HIGH
========================================================================================================================= [SUCCESS] Took 7.79 seconds =========================================================================================================================
Environment Status Duration
-------------------------- -------- ------------
esp32doit-devkit-v1-jtag IGNORED
esp32doit-devkit-v1-serial SUCCESS 00:00:07.786
========================================================================================================================= 1 succeeded in 00:00:07.786 =========================================================================================================================
Does this look like a successful flash or am I missing something.
After installing the requirements and I scan for devices and it will find my iPhone:
root@u18:~/src/release/wdissector# bin/bt_fuzzer --scan
Enabling Core dump: ulimit -c unlimited
Loading Model...
Model Loaded. Total States:169 Total Transistions:1299
Loop detection ENABLED
[Modules] Loading C++ Modules...
[Modules] --> repeated_host_connection.so loaded
[Modules] --> duplicated_encapsulated_payload.so loaded
[Modules] --> lmp_overflow_2dh1.so loaded
[Modules] --> noncomplicance_duplicated_encryption_request.so loaded
[Modules] --> knob.so loaded
[Modules] --> sdp_oversized_element_size.so loaded
[Modules] --> au_rand_flooding.so loaded
[Modules] --> lmp_invalid_transport.so loaded
[Modules] --> lmp_max_slot_overflow.so loaded
[Modules] --> truncated_lmp_accepted.so loaded
[Modules] --> paging_scan_disable.so loaded
[Modules] --> invalid_max_slot.so loaded
[Modules] --> feature_response_flooding.so loaded
[Modules] --> invalid_feature_page_execution.so loaded
[Modules] --> lmp_auto_rate_overflow.so loaded
[Modules] --> noncompliance_invalid_stop_encryption.so loaded
[Modules] --> truncated_sco_link_request.so loaded
[Modules] --> wrong_encapsulated_payload.so loaded
[Modules] --> sdp_unkown_element_type.so loaded
[Modules] --> duplicated_iocap.so loaded
[Modules] --> feature_req_ping_pong.so loaded
[Modules] --> lmp_overflow_dm1.so loaded
[Modules] --> invalid_timing_accuracy.so loaded
[Modules] --> invalid_setup_complete.so loaded
[Modules] 24/24 Modules Compiled / Loaded
[Python] Version 3.8.6 initialized
[PythonServer] Server Module "RESTServer.py" imported
[PythonServer] Server initialized at 127.0.0.1:3000
[Optimizer] Algorithm name: GPSO: Generational Particle Swarm Optimization [stochastic]
C++ class name: pagmo::pso_gen
Thread safety: basic
Extra info:
Generations: 100
Omega: 0.7298
Eta1: 2.05
Eta2: 2.05
Maximum velocity: 0.5
Variant: 5
Topology: 2
Topology parameter: 4
Memory: false
Seed: 123456789
Verbosity: 1
Problem name: WDissector
C++ class name: Fitness::problem_basic
Global dimension: 683
Integer dimension: 0
Fitness dimension: 1
Number of objectives: 1
Equality constraints dimension: 0
Inequality constraints dimension: 0
Lower bounds: [0, 0, 0, 0, 0, ... ]
Upper bounds: [0.2, 0.2, 0.2, 0.2, 0.2, ... ]
Has batch fitness evaluation: false
Has gradient: false
User implemented gradient sparsity: false
Has hessians: false
User implemented hessians sparsity: false
Fitness evaluations: 0
Thread safety: basic
Extra info:
WDissector Fuzzing Engine.
[Optimizer] Initialized with X Size=683, Population Size=5
Access Documentation:
https://asset-sutd.gitlab.io/software/wireless-deep-fuzzer/
[ESP32BT] HCI Bridge ON: /dev/pts/3
[PythonServer] Server Started
UART Latency reduced to 125 us
[ESP32BT] Firmware version: 1.3.0
[ESP32BT] LMP Sniffing ENABLED
[ESP32BT] TX Packet interception ENABLED
[ESP32BT] [!] RX Bypass DISABLED
[ESP32BT] [!] Bypass on Demand DISABLED
[ESP32BT] [!] Role Switch ENABLED
[ESP32BT] Own BDADDR set to 3b:e3:1c:68:b0:45
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:136 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
BT Scanning Started (Inquiry)...
[ESP32BT] BDAddress: 88:a4:79:XX:XX:XX, Name: XXX, RSSI: -62, Class: Smartphone
BT Scanning Finished, got 1 result(s).
Merged logs saved to logs/Bluetooth/logs_merged.txt
Fuzzer Closed
However when I try to attach I will get the following output:
root@u18:~/src/release/wdissector# bin/bt_exploiter --host-port=/dev/ttyUSB1 --target=88:a4:XX:XX:XX:XX --exploit=au_rand_flooding
Logical Cores: 4
No SMT support
Assigned CPUSET:
CPU 0 Allowed
CPU 1 Allowed
CPU 2 Allowed
CPU 3 Allowed
sched_setscheduler: Current process set to realtime (RR Scheduler)
Thread priority is 99
/proc/sys/kernel/sched_rt_runtime_us = -1
Enabling Core dump: ulimit -c unlimited
Loading Model...
Model Loaded. Total States:169 Total Transistions:1299
Loop detection ENABLED
[Modules] Loading C++ Modules...
[Modules] --> repeated_host_connection.so loaded
[Modules] --> duplicated_encapsulated_payload.so loaded
[Modules] --> lmp_overflow_2dh1.so loaded
[Modules] --> noncomplicance_duplicated_encryption_request.so loaded
[Modules] --> knob.so loaded
[Modules] --> sdp_oversized_element_size.so loaded
[Modules] --> au_rand_flooding.so loaded
[Modules] --> lmp_invalid_transport.so loaded
[Modules] --> lmp_max_slot_overflow.so loaded
[Modules] --> truncated_lmp_accepted.so loaded
[Modules] --> paging_scan_disable.so loaded
[Modules] --> invalid_max_slot.so loaded
[Modules] --> feature_response_flooding.so loaded
[Modules] --> invalid_feature_page_execution.so loaded
[Modules] --> lmp_auto_rate_overflow.so loaded
[Modules] --> noncompliance_invalid_stop_encryption.so loaded
[Modules] --> truncated_sco_link_request.so loaded
[Modules] --> wrong_encapsulated_payload.so loaded
[Modules] --> sdp_unkown_element_type.so loaded
[Modules] --> duplicated_iocap.so loaded
[Modules] --> feature_req_ping_pong.so loaded
[Modules] --> lmp_overflow_dm1.so loaded
[Modules] --> invalid_timing_accuracy.so loaded
[Modules] --> invalid_setup_complete.so loaded
[Modules] 24/24 Modules Compiled / Loaded
[Modules] au_rand_flooding configured and ready!
[ESP32BT] HCI Bridge ON: /dev/pts/3
[ESP32BT] Firmware version: 1.3.0
[ESP32BT] LMP Sniffing ENABLED
[ESP32BT] TX Packet interception ENABLED
[ESP32BT] RX Bypass ENABLED
[ESP32BT] [!] Bypass on Demand DISABLED
[ESP32BT] [!] Role Switch ENABLED
[ESP32BT] Own BDADDR set to ba:fd:bd:63:1e:c4
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:120 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
[Monitor] ERROR: Could not open /ev/ttyUSB3@115200
Host BDAddress randomized to 4a:57:10:6c:34:95
[!] Global timeout started with 45 seconds
[BT Program] Starting program bin/sdp_rfcomm_query -u /dev/pts/3 -a 88:a4:XX:XX:XX:XX --iocap 3 --authreq 3 --bounding 1
Packet Log: logs/Bluetooth/hci_dump.pklg
H4 device: /dev/pts/3
address=88:a4:79:a6:b2:79
iocap=3
authreq=3
bouding=1
Local version information:
- HCI Version 0x0008
- HCI Revision 0x030e
- LMP Version 0x0008
- LMP Subversion 0x030e
- Manufacturer 0x0060
Unknown manufacturer / manufacturer not supported yet.
Local name:
BTstack up and running on 4A:57:10:6C:34:95.
^CCTRL-C - SIGINT received, shutting down..
[Machine] Config Saved: configs/bt_config.json
Fuzzer Closed
Is the warning regarding ttyUSB3 expected behaviour? I was not able to find any typo with USB3 in the files provided.
Hi,
I followed the instructions provided but when I run ./bin/bt_fuzzer
I get:
[xcb] Extra reply data still left in queue
[xcb] This is most likely caused by a broken X extension library
[xcb] Aborting, sorry about that.
bt_fuzzer: ../../src/xcb_io.c:673: _XReply: Assertion `!xcb_xlib_extra_reply_data_left' failed.
Aborted
Any idea what could be the root cause?
I edited configs/bt_config.json
to have bin/sdp_general_query
as the 2nd entry in the "DefaultPrograms" array (since it seems to like to launch the 2nd entry first.) When I do this, I get the error:
[BT Program] Starting program bin/sdp_general_query -u /dev/pts/8 -a A8:66:7F:A1:B2:C3 --iocap 3 --authreq 3 --bounding 1
Packet Log: logs/Bluetooth/hci_dump.pklg
H4 device: /dev/pts/8
Usage: /home/user/Downloads/braktooth_esp32_bluetooth_classic_attacks/wdissector/bin/sdp_general_query -a|--address aa:bb:cc:dd:ee:ff
Use argument -a to connect to a specific device and dump the result of SDP query for L2CAP services.
Clearly there's a -a specified, so something else is going on. What I found by launching manually is that bin/sdp_general_query
doesn't like any arguments after the -a. If I run it without the --iocap etc args after -a, I don't get the error. (Though I also don't get any output, though I'm not sure if I'm supposed to if it's launched manually.)
I'm not really sure where to edit to alter this, so I thought I'd just let you know. (Note: even if you move -a to last, it will still error out.)
As the title suggests, I have encountered some Bluetooth targets that require pairing before I can continue fuzzing. However, I need to know what the pairing code is. I saw in the README
that I can specify thePIN code
to use in the config file. But first, I need to know the pairing code calculated between the ESP32 and the target Bluetooth device. This issue has been bothering me for a long time. I would like to ask if you have any good solutions. I noticed that your design must have considered the pairing issue, but I am confused about how to input the correct pairing code. I hope you can see this and provide guidance. Thank you!
Hi,
thanks for publishing the tooling for the ESP32 :)
I finally had some time to take a look into the source code and realized that only the source for the exploits is available in wdexploiter/modules/exploits
. However, the source code for wdexploiter/bin/bt_exploiter
is missing. Thus, the ESP32 tooling allows to configure BLE packets according to the definitions but not adding any other undefined behavior.
Did I just miss the source code? It would be really interesting to have a binary patcher for the ESP32 firmware.
Hi,
Thanks for the research and work done on this regard.
I need to do a bit of bluetooth testing at home so I headed to mouser to get the hardware needed. The following is what I found.
As you can see it is a ESP-WROVER-KITVE, not a ESP-WROVER-KIT.
https://www.mouser.es/ProductDetail/356-ESP-WROVER-KITVE
Is it compatible to perform a proper and clean installation and able to launch the attacks?
Thanks!
what does it mean in the monitor? What kind of device should be there?
[ESP32BT] HCI Bridge ON: /dev/pts/1
[Monitor] ERROR: Could not open /dev/ttyUSB2@115200
I do according to the instructions from here: #2 (comment)
I run the sudo bin/bt_fuzzer command
Are there video instructions on how and what to use? I'm just a complete 0 in this :(
For "Enable Bounding" in the README.md and "EnableBounding" in configs/bt_config.json
, shouldn't this be "Bonding" rather than "Bounding", as the official BT term? Similarly there are multiple instances in the README.md of "Bouding" which should probably be "Bonding" as well.
And then in the "BT Program" table, you currently list only bin/sdp_rfcomm_query
, but from the configs/bt_config.json
, I can see that the total supported list is currently:
"bin/spp_counter",
"bin/sdp_rfcomm_query",
"bin/sdp_general_query",
"bin/sdp_bnep_query",
"bin/a2dp_sink_demo",
"bin/a2dp_source_demo"
Edit: Maybe sdp_rfcomm_query
is the only one listed, because none of the others work / send any packets currently? (At least in my tests... Although I guess a couple are listeners rather than senders...)
Also semi-related, I set up BrakTooth on a new Ubuntu 22.04 system, and various libraries were missing. Only after I then also installed all the prereqs from the esp32 sniffer/fuzzer project would BrakTooth run. So the requirements.sh is probably missing some things, and this repo's installation instructions don't stand alone (at least on Ubuntu 22.04).
Hello ,guys ;
I am having some trouble using these ESP32 development boards, I find the UART latency is 1259us and wonder how to reduce the latency of this serial port?
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:1259 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
Hello! i tried to follow the guide, and actually i have something.
Im able to list the exploits
> sudo bin/bt_exploiter --list-exploits
> Enabling Core dump: ulimit -c unlimited
> Loading Model...
> Model Loaded. Total States:169 Total Transistions:1299
> Loop detection ENABLED
> [Modules] Loading C++ Modules...
> [Modules] --> noncompliance_invalid_stop_encryption.so loaded
> [Modules] --> paging_scan_disable.so loaded
> [Modules] --> truncated_sco_link_request.so loaded
> [Modules] --> duplicated_iocap.so loaded
> [Modules] --> sdp_oversized_element_size.so loaded
> [Modules] --> truncated_lmp_accepted.so loaded
> [Modules] --> lmp_max_slot_overflow.so loaded
> [Modules] --> noncomplicance_duplicated_encryption_request.so loaded
> [Modules] --> invalid_timing_accuracy.so loaded
> [Modules] --> wrong_encapsulated_payload.so loaded
> [Modules] --> lmp_auto_rate_overflow.so loaded
> [Modules] --> invalid_feature_page_execution.so loaded
> [Modules] --> au_rand_flooding.so loaded
> [Modules] --> invalid_max_slot.so loaded
> [Modules] --> repeated_host_connection.so loaded
> [Modules] --> lmp_overflow_2dh1.so loaded
> [Modules] --> knob.so loaded
> [Modules] --> invalid_setup_complete.so loaded
> [Modules] --> feature_req_ping_pong.so loaded
> [Modules] --> duplicated_encapsulated_payload.so loaded
> [Modules] --> sdp_unkown_element_type.so loaded
> [Modules] --> feature_response_flooding.so loaded
> [Modules] --> lmp_overflow_dm1.so loaded
> [Modules] --> lmp_invalid_transport.so loaded
> [Modules] 24/24 Modules Compiled / Loaded
> Available Exploits:
> --> 'noncompliance_invalid_stop_encryption'
> --> 'paging_scan_disable'
> --> 'truncated_sco_link_request'
> --> 'duplicated_iocap'
> --> 'sdp_oversized_element_size'
> --> 'truncated_lmp_accepted'
> --> 'lmp_max_slot_overflow'
> --> 'noncomplicance_duplicated_encryption_request'
> --> 'invalid_timing_accuracy'
> --> 'wrong_encapsulated_payload'
> --> 'lmp_auto_rate_overflow'
> --> 'invalid_feature_page_execution'
> --> 'au_rand_flooding'
> --> 'invalid_max_slot'
> --> 'repeated_host_connection'
> --> 'lmp_overflow_2dh1'
> --> 'knob'
> --> 'invalid_setup_complete'
> --> 'feature_req_ping_pong'
> --> 'duplicated_encapsulated_payload'
> --> 'sdp_unkown_element_type'
> --> 'feature_response_flooding'
> --> 'lmp_overflow_dm1'
> --> 'lmp_invalid_transport'
but when i try to, for example scan sudo bin/bt_exploiter --scan
i got this error.
Enabling Core dump: ulimit -c unlimited
Loading Model...
Model Loaded. Total States:169 Total Transistions:1299
Loop detection ENABLED
[Modules] Loading C++ Modules...
[Modules] --> noncompliance_invalid_stop_encryption.so loaded
[Modules] --> paging_scan_disable.so loaded
[Modules] --> truncated_sco_link_request.so loaded
[Modules] --> duplicated_iocap.so loaded
[Modules] --> sdp_oversized_element_size.so loaded
[Modules] --> truncated_lmp_accepted.so loaded
[Modules] --> lmp_max_slot_overflow.so loaded
[Modules] --> noncomplicance_duplicated_encryption_request.so loaded
[Modules] --> invalid_timing_accuracy.so loaded
[Modules] --> wrong_encapsulated_payload.so loaded
[Modules] --> lmp_auto_rate_overflow.so loaded
[Modules] --> invalid_feature_page_execution.so loaded
[Modules] --> au_rand_flooding.so loaded
[Modules] --> invalid_max_slot.so loaded
[Modules] --> repeated_host_connection.so loaded
[Modules] --> lmp_overflow_2dh1.so loaded
[Modules] --> knob.so loaded
[Modules] --> invalid_setup_complete.so loaded
[Modules] --> feature_req_ping_pong.so loaded
[Modules] --> duplicated_encapsulated_payload.so loaded
[Modules] --> sdp_unkown_element_type.so loaded
[Modules] --> feature_response_flooding.so loaded
[Modules] --> lmp_overflow_dm1.so loaded
[Modules] --> lmp_invalid_transport.so loaded
[Modules] 24/24 Modules Compiled / Loaded
[ESP32BT] HCI Bridge ON: /dev/pts/5
Setting UART flag ASYNC_LOW_LATENCY
[ESP32BT] Firmware version not detected
Serial port could not open.
BT Scanning Started (Inquiry)...
Setting UART flag ASYNC_LOW_LATENCY
[ESP32BT] Firmware version not detected
Setting UART flag ASYNC_LOW_LATENCY
[ESP32BT] Firmware version not detected
^CMerged logs saved to logs/Bluetooth/logs_merged.txt
Fuzzer Closed
i used to had another error which said something like Could not open /dev/ttyUSB2@115200
, i used a python module to clear the esp32 and reinstall the firmware python -m esptool --chip esp32 erase_flash
im in 6.1.0-kali7-amd64
Hi @Matheus-Garbelini, for this project is it valid the same suggestion of this comment Matheus-Garbelini/esp32_bluetooth_classic_sniffer#2 (comment) ?
I submitted the source request form twice with my academic email address but did not get a response for over a month.
Can you help with this?
I'm getting the following error when I'm trying to run the second instruction
zstd: /*stdin*\: unsupported format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
Is there something wrong with the file?
Please advise
Hello Braktooth team!
My goal is to use the PoC's feature response flooding to crash a DOSS SoundBox Wireless Portable Bluetooth Speaker I've got. I'm following through the README included in the proof of concept, and I'm running into an issue. I can't seem to find the speaker when I scan with sudo bin/bt_exploiter --scan
.
Here is an excerpt from the output when calling sudo bin/bt_exploiter --scan
:
[ESP32BT] Probing /dev/ttyUSB1 at 4000000 baudrate...
[ESP32BT] Got valid response from /dev/ttyUSB1
[ESP32BT] Firmware version: 1.3.0
[ESP32BT] LMP Sniffing ENABLED
[ESP32BT] TX Packet interception ENABLED
[ESP32BT] RX Bypass ENABLED
[ESP32BT] [!] Bypass on Demand DISABLED
[ESP32BT] [!] Role Switch ENABLED
[ESP32BT] Own BDADDR set to 50:4a:35:a0:6c:6f
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:142 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
BT Scanning Started (Inquiry)...
[ESP32BT] BDAddress: f8:59:71:63:b9:d2, Name: ACOMBSR-5520, RSSI: -75, Class: Laptop
[ESP32BT] BDAddress: 90:61:ae:87:e0:32, Name: charlie-HP-ZBook-Studio-G4, RSSI: -57, Class: Laptop
[ESP32BT] BT Scanning Finished, got 2 result(s).
Fuzzer Closed
The fundamental problem is that the scanning function is finding far fewer BT devices than there are actually available. My phone will see 6+ potential connections while scanning shows only 2.
So far, I have tried 2 fixes, neither of which worked: Putting the speaker into pairing mode, and sourcing the speaker's BDAddress from somewhere else. Putting the speaker in pairing mode did not make a difference. I tried to use the BDAddress my computer gives me when I connect to the speaker, but when attempting the exploit, it seems the ESP32 cannot connect the speaker, printing:
BTstack up and running at 3B:41:CF:56:EF:E5
[Baseband] TX --> FHS
SDP query failed 0x04, retrying...
[Baseband] TX --> FHS
[Timeout] No Response received for 30 seconds
[Timeout] Target is not responding, check if target is still alive...
I'm a newbie to security and bluetooth stuff, but the report and docs you guys have made for braktooth have been immensely helpful. Many thanks for all the work you have done and for any help with this issue.
Sincerely,
Charlie
Is it not allowed to send packets from within rx_post_dissection()
? I didn't see any other example exploit modules that do that, and the exploit guide PDF only shows an example of sending from within rx_pre_dissection()
, but I think I need to wait until post-dissection so I know I'm dealing with the LMP_name_res
. And when I do a simple case of this, it seems to crash if sent from rx_post_dissection()
, but work if send from tx_post_dissection()
static uint8_t packet[] = {0x99, 0x03, 0x17, 0x00, // Baseband + ACL Header
0x02, 0x00}; // LSB TID = 0 + LMP opcode (0x01) and name offset (0)
static int rx_post_dissection(uint8_t *pkt_buf, int pkt_length, void *p)
{
if (packet_read_filter(filter_lmp_features_res))
{
wd_log_y("LMP_features_res RX detected");
module_request_t *m = (module_request_t *)p;
m->tx_count = 1;
m->pkt_buf = packet;
m->pkt_len = sizeof(packet);
return 0;
}
The below is the aborted sequence that seems like the firmware's crashing or something after the LMP_name_req
is sent (or attempted to be sent):
Starting RFCOMM Query
[Baseband] TX --> FHS
[Modules] LMP_features_req TX detected
[LMP] TX --> LMP_features_req
[Modules] LMP_features_res RX detected
[LMP] RX <-- LMP_features_res
[LMP] TX --> LMP_features_req_ext
0:[LMP] TX --> LMP_name_req
[!] ESP32 Driver Startup/Restart
[ESP32BT] Discovering Serial Port
[ESP32BT] Probing /dev/ttyUSB0 at 4000000 baudrate...
[ESP32BT] No response
[ESP32BT] Probing /dev/ttyUSB1 at 4000000 baudrate...
[ESP32BT] No response
[ESP32BT] Firmware version: 1.3.0
If I instead move the packet sending to when the LMP_features_req
is sent, rather than when the LMP_features_rsp
is received, it works fine. But that's still problematic, because for a LMP_name_req
, it'd make the most sense to send the next req after the res is processed, to determine if the next one's even needed or not. I can probably work around this by setting a global flag or something and keeping the send in the tx callback, but I'm just wondering if I'm doing something obviously wrong which is why it's not possible to send from the rx, or whether it's just not supported. Thanks in advance.
This is just a curiosity thing, but what's the difference between returning 0 vs. 1 in the callbacks?
And where can I find the BDADDR that was connected to (from within an exploit module), so I can add it to logs or output different logs per BDADDR?
should be python3 firmware.py flash /dev/ttyUSB3
$ python3 firmware.py /dev/ttyUSB3
------ Usage help -------
./firmware.py **flash** <port name> # Flash firmware using serial port
./firmware.py reset <port name> # Reset firmware using serial port
the bin/bt_exploiter still try to probe ttyUSB0/1/2, even the ttyUSB3 has been specified by '--host-port' arg.
sudo bin/bt_exploiter --host-port=/dev/ttyUSB3 --target=xx:xx:xx:xx:xx:xx --exploit=au_rand_flooding
Logical Cores: 4
No SMT support
Assigned CPUSET:
CPU 0 Allowed
CPU 1 Allowed
CPU 2 Allowed
CPU 3 Allowed
sched_setscheduler: Current process set to realtime (RR Scheduler)
Thread priority is 99
/proc/sys/kernel/sched_rt_runtime_us = -1
Enabling Core dump: ulimit -c unlimited
Loading Model...
Model Loaded!
[Modules] Loading C++ Modules...
GCC not found, modules won't be compiled from source.
[Modules] --> duplicated_iocap.so loaded
[Modules] --> wrong_encapsulated_payload.so loaded
[Modules] --> invalid_timing_accuracy.so loaded
[Modules] --> invalid_max_slot.so loaded
[Modules] --> duplicated_encapsulated_payload.so loaded
[Modules] --> sdp_unkown_element_type.so loaded
[Modules] --> sdp_oversized_element_size.so loaded
[Modules] --> invalid_feature_page_execution.so loaded
[Modules] --> repeated_host_connection.so loaded
[Modules] --> paging_scan_disable.so loaded
[Modules] --> feature_req_ping_pong.so loaded
[Modules] --> feature_response_flooding.so loaded
[Modules] --> au_rand_flooding.so loaded
[Modules] --> lmp_overflow_2dh1.so loaded
[Modules] --> lmp_auto_rate_overflow.so loaded
[Modules] --> noncompliance_invalid_stop_encryption.so loaded
[Modules] --> noncomplicance_duplicated_encryption_request.so loaded
[Modules] --> knob.so loaded
[Modules] --> lmp_overflow_dm1.so loaded
[Modules] --> invalid_setup_complete.so loaded
[Modules] --> truncated_lmp_accepted.so loaded
[Modules] --> truncated_sco_link_request.so loaded
[Modules] --> lmp_max_slot_overflow.so loaded
[Modules] 23/23 Modules Compiled / Loaded
[Modules] au_rand_flooding configured and ready!
[ESP32BT] HCI Bridge ON: /dev/pts/4
[ESP32BT] Discovering Serial Port
[ESP32BT] Probing /dev/ttyUSB0 at 4000000 baudrate...
[ESP32BT] No response
[ESP32BT] Probing /dev/ttyUSB1 at 4000000 baudrate...
[ESP32BT] No response
[ESP32BT] Probing /dev/ttyUSB2 at 4000000 baudrate...
[ESP32BT] No response
[ESP32BT] Probing /dev/ttyUSB3 at 4000000 baudrate...
[ESP32BT] Got valid response from /dev/ttyUSB3
[ESP32BT] Firmware version: 1.3.0
I am following exactly everything in the readme page.
running install_scripts
adding license file "LICENSE" (matched pattern "LICEN[CS]E*")
error: [Errno 26] Text file busy: 'build/bdist.linux-x86_64/wheel/platformio-6.1.4-py3.6.egg-info'
and then
Generating project.checksum
Traceback (most recent call last):
File "firmware.py", line 181, in
flash_firmware(args[i + 1])
File "firmware.py", line 103, in flash_firmware
generate_project_checksum()
File "firmware.py", line 53, in generate_project_checksum
checksum = sha1(get_platformio_version())
File "firmware.py", line 41, in get_platformio_version
['pio', '--version'], stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout
File "/usr/lib/python3.6/subprocess.py", line 423, in run
with Popen(*popenargs, **kwargs) as process:
File "/usr/lib/python3.6/subprocess.py", line 729, in init
restore_signals, start_new_session)
File "/usr/lib/python3.6/subprocess.py", line 1364, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'pio': 'pio'
I tried holding the boot button and then En button on the KIT, but do not help.
Please advice.
Hi, I need some help-
I got most of it working, but not able to test any of the attacks...
Setup:
ESP32-WROOM32U + ESP-PROG
VMWare + Ubuntu 18.04
Connecting the ESP-PROG (only) to USB, gives me /dev/ttyUSB0, and ttyUSB1, where USB1 is the ESP32.
Firmware:
Flashed the firmware to the ESP32 directly via USB.
The version-checker python script (found in the comments somewhere - send 0xEE) - reports firmware version v1.3.0
DNS:
While running requirements.sh, dnsmasq installs, but fails to start.
Also fails to start during system startup.
dnsmasq[877]: failed to create listening socket for port 53: Address already in use
Looks like I have systemd-resolve sitting on port 53.
Not sure if this 'error' is permissable or if I need to fix dnsmasq?
Config:
configs/bt_config.json - set SerialAutoDiscovery to false
Scanning:
bt_fuzzer scan works. I can pick up devices that are waiting to pair. Paired devices or in-use devices do not show up.
No errors logged during scan.
UART Latency reported as 125 us, though sometimes also around 240 us.
Questions:
Any suggestions?
sudo bin/bt_exploiter --host-port=/dev/ttyUSB1 --target=xx:xx:xx:xx:xx:xx --exploit=invalid_max_slot
Log chunk:
[Modules] 24/24 Modules Compiled / Loaded
[Modules] invalid_max_slot configured and ready!
[ESP32BT] HCI Bridge ON: /dev/pts/0
[ESP32BT] Firmware version: 1.3.0
[ESP32BT] LMP Sniffing ENABLED
[ESP32BT] TX Packet interception ENABLED
[ESP32BT] [!] RX Bypass DISABLED
[ESP32BT] [!] Bypass on Demand DISABLED
[ESP32BT] [!] Role Switch ENABLED
[ESP32BT] Own BDADDR set to xx:xx:xx:xx:xx:xx
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:14116 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
[Monitor] Port /dev/ttyUSB0@115200 Opened
...
Starting RFCOMM Query
[Baseband] TX --> FHS
[Baseband] RX <-- FHS
[Timeout] No Response received for 45 seconds
[Timeout] Target is not responding, check if target is still alive...
Host BDAddress randomized to xx:xx:xx:xx:xx:xx
[!] Global timeout started with 45 seconds
The log line-
[Monitor] Port /dev/ttyUSB0@115200 Opened...
Is that strange? ttyUSB0 is the ESP-PROG I believe...
I noticed somewhere in the comments, firmware of 1.4 mentioned? The firmware included in https://github.com/Matheus-Garbelini/braktooth_esp32_bluetooth_classic_attacks/blob/master/esp32driver.zip is v1.3
I think the firmware in
https://github.com/Matheus-Garbelini/esp32_bluetooth_classic_sniffer/tree/master/firmware is newer? Should I flash to this version? (v1.4?)
Any advice on what what attack(s) I should be focusing on for a basic smartphone -> audio device scenario?
The scanning ONLY pics up devices in pairing mode. Is this a limitation of the scanning technique, or is something not working on my end?
Is it possible to detect devices that are already paired?
Do I need another tool for that? Bettercap?
In a basic smartphone -> audio device scenario, what should the target BDaddr be? The smartphone or the audio device? either?
Thanks in advance.
Hello guys !
Hope you're doing well ?
I would like to know if I could run this exploits with my ESP32 NodeMCU ?
Sorry but i'm quite a noob aha
Thank you in advance for your help !
Best regards 🙂
My linux knowledge is 0 :(
When executing point B of the instruction, I get an error, and I can't find a solution
┌──(kali㉿kali)-[~/braktooth_esp32_bluetooth_classic_attacks]
└─$ tar -I zstd -xf wdissector.tar.zst
zstd: /stdin: unsupported format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
tar version:
tar (GNU tar) 1.34
zstd version:
*** zstd command line interface 64-bits v1.5.2, by Yann Collet ***
Kali version:
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2022.3
Codename: kali-rolling
Probably not an actual problem with the code, could someone help me with an error I'm getting? I'm on literally the second step where I have to flash the firmware and I am getting an error no matter which serial port I use (both show up when I use ls) and regardless of if my esp is in boot mode. Not a big coder, someone pls help me out!
Kali Linux VM (most recent vers) thru VMWare on a Windows 11 machine plugged into a wrover kit
has this been tested to work with ubuntu 22.04/20.04? also, does this also work with wrover e or only wrover B?
Why can't I execute the command "sudo bin/bt_fuzzer"?
┌──(kali㉿kali)-[~/braktooth_esp32_bluetooth_classic_attacks/wdissector]
└─$ sudo bin/bt_fuzzer --help
bin/bt_fuzzer: error while loading shared libraries: libtbb.so.2: cannot open shared object file: No such file or directory
Kali version:
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2022.3
Codename: kali-rolling
┌──(kali㉿kali)-[~/braktooth_esp32_bluetooth_classic_attacks/wdissector]
└─$ sudo apt-get install libtbb2
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package libtbb2 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
libtbbmalloc2
┌──(kali㉿kali)-[~/braktooth_esp32_bluetooth_classic_attacks/wdissector]
└─$ sudo apt-get install libtbb-dev
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
libtbb-dev is already the newest version (2021.7.0-1).
The following packages were automatically installed and are no longer required:
libwireshark15 libwiretap12 libwsutil13
Use 'sudo apt autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 1190 not upgraded.
Hello, I went through the installation instructions by flashing the firmware on the ESP-WROVER-KIT and installing all the system requirements from the wdissector package. Afterwards I tried to test it out by running the BT fuzzer; however, I received the following error.
bin/bt_fuzzer: error while loading shared libraries: libgvc.so.6: cannot open shared object file: No such file or directory
Do you have any suggestions to fix this?
Hi there,
I would like to run this on arch Linux as running in a VM is extremely slow and appears to be causing issues.
However I wasn't able to obtain the same versions of dependencies as installed on Ubuntu by the requirements.sh script. When trying to run the bt_fuzzer
I'm also getting a symbol lookup error in wdissector/bin/libpagmo.so.6
So I was looking for a way of recompiling the sources.
I found this in wdissector/docs
1.1) Compile from source (optional)
Several requirements needs to be installed before compiling the project. An automated script for Ubuntu 18.04/20.04 is provided on requirements.sh. To compile from source, simply run the following commands:
git clone https://gitlab.com/asset-sutd/software/wireless-deep-fuzzer -b wdissector --depth=1
cd wdissector
./requirements.sh dev # Install all requirements to compile wdissector from source
./requirements.sh doc # Install nodejs requirements to generate documentation
./build.sh all # Compile all binaries. It may take around 15min. Go get a coffe!
./build.sh doc # Generate documentation
Unfortunately the gitlab project is no longer available and the build script is not part of the wdissector.tar.zst
file of this repo.
Is there anyway for me to recompile the project on arch or am I forced to set up a machine with Ubuntu?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.